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FOREWORD 


This document constitutes the final report of the design, acquisition, and test planning 
phases of the Test ACT System, a portion of the Integrated Application of Active 
Controls (IAAC) Technology to an Advanced Subsonic Transport Project. The report 
covers work performed from June 1981 through June 1983 under Contract NASI -15325. 

The NASA Technical Monitor for this task was D. B. Middleton of the Energy Efficient 
Transport Project Office at Langley Research Center. 

The work was accomplished by people of (1) the Preliminary Design department of the 
Vice President-Engineering organization of Boeing Commercial Airplane Company and (2) 
the Collins Air Transport Division of Rockwell International, operating under purchase 
order Y-405143-0935 F. 

Key Boeing contributors were: 


G. W. Hanks 

Program Manager 

H. A. Shomber 

IAAC Project Manager 

G. E. Talberg 

Task Manager-Test ACT 

D. E. Chichester 

Flight Controls Technology 

I. G. Barker 

Flight Controls Design 

C. B. Crumb, Jr. 

Flight Controls Design 

R. J. Dorwart 

Product Assurance 

C. C. Flora 

Flight Controls Technology 

J. M. Hunt 

Flight Controls Design 

D. J. Maund 

Flight Controls Technology 

K.A.B. Macdonald 

Product Assurance 

B. E. Sammons 

Flight Controls Design 

J. Shen 

Flight Controls Technology 

W. F. Shivitz 

Flight Controls Technology 

R. A. Smith 

Flight Controls Design 


Key Collins contributors were: 


C. E. Butler 
T. E. Foster 

R. A. Buckheister 
T. M. Carlson 
E. P. Kosowski 
L. D. Lacy 

D. A. Roush 

R. F. Tribuno 

S. Van Delien 


Program Manager 
Technical Director 
System Design Engineer 
On-Site Technical Liaison 
Software Manager 
Hardware Design Engineer 
Lead Hardware Design Engineer 
Lead System Design Engineer 
Lead Software Design Engineer 


During this work, principal measurements and calculations were made in customary units 
and were converted to Standard International units for this document. 


Use of trade names or names of manufacturers in this report does not constitute an 
official endorsement of such products or manufacturers, either expressed or implied, by 
the National Aeronautics and Space Administration. 
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1.0 SUMMARY 


This report covers a portion of the final program element in the Integrated Application of 
Active Controls (IAAC) Technology to an Advanced Subsonic Transport Project, a part of 
the NASA Energy Efficient Transport Program. It documents the design and acquisition 
of the Test ACT System; planned continuation of that project includes laboratory testing 
and, later, flight test. 

The work reported here was done by an integrated engineering and fabrication 
organization drawn from the Preliminary Design department of Boeing Commercial 
Airplane Company and Collins Air Transport Division of Rockwell International. In the 
period November 1981 to 3une 1983, this organization accomplished the following: 

• Selected the system concept and the test airplane 

• Performed the system design 

• Designed and analyzed the control laws and tested them by piloted simulation 

• Designed, fabricated, and bench tested the computer hardware, both digital and 
analog 

• Designed, integrated, and verified the digital system software 

• Selected and procured the system sensors 

• Designed, fabricated, and bench tested the man-machine interface equipment for the 
flight crew and the test engineering personnel 

• Designed modifications to the test aircraft, adding redundant secondary servos for 
elevator position commands 

• Planned laboratory and flight test programs 

• Documented all of the above steps 

The end product of this work is an active controls system composed of pitch-augmented 
stability, pitch fly by wire, and wing-load alleviation, including both maneuver-load 
control and gust-load alleviation, for the Boeing 757-200 flight test airplane. The 
electronic equipment is mounted in consoles so it can be readily tested in the laboratory 
and then moved into the airplane with a minimum of dismantling. 

The system is now installed in a prepared position at the Boeing Digital Avionics Flight 
Controls Laboratory for a series of detailed tests. This laboratory testing began with 



hardware and software open-loop testing and will progress through failure detection, 
system integration, and finally into closed-loop testing, with increasing fidelity in 
simulation of flight operations, all in preparation for later installation and flight test in a 
757-200 airplane. 
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2.0 INTRODUCTION 


2.1 IAAC PROJECT OVERVIEW 

The Integrated Application of Active Controls (IAAC) Technology to an Advanced 
Subsonic Transport Project has had three major objectives. The first objective was 
assessment of benefits to a commercial transport of the full application of active controls 
that are designed into the airplane from the beginning of a production program. The 
second objective was identification of the risks associated with the use of Active Controls 
Technology (ACT). The third objective is reduction of these risks, through test and 
evaluation, to a level commensurate with commercial practice— to the degree possible 
within the project's funding limitations. 

This project was organized into three major elements, as shown at the top of Figure 1 
(ref. 1). The first major element, Configuration/ ACT System Design and Evaluation, 
included establishment of the design criteria appropriate for an ACT airplane (designed 
from the outset to utilize active controls), design of an ACT airplane configuration to 
meet the selected criteria, design of an active controls system based upon current 
technology, and selection and evaluation of a Final ACT airplane configuration. The 
results of these studies are documented in References 2, 3, 4, 5, 6, and 7. 

In parallel with these tasks, the second major element, Advanced Technology ACT Control 
System Definition (fig. 2), included exploration of optimal control synthesis methods, 
alternative means of implementing the ACT functions using advanced technology, and an 
examination of the integration of ACT, control, and guidance functions. The results of 
these studies are documented in References 2, 3, and 8. 

The final major element, Test and Evaluation, is shown in Figure 3. The components of 
this element, first conceived in the development of the Project Plan (ref. 1) and also 
shown in the figure, address reduction of the risk associated with implementation of 
active controls on a commercial transport. Subsequent to publication of the Project Plan, 
it was concluded that it would be inappropriate to conduct the wind tunnel tests described 
in that plan under NASA funding. The software-implemented fault tolerance (SIFT) and 
fault tolerant multiprocessor (FTMP) projects sponsored by NASA Langley Research 
Center and currently under test in the Langley AIRLAB have been considered throughout 
the IAAC Project, but did not directly influence the Test ACT system architecture. 
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A piloted simulation evaluation has been completed, the results of which are reported in 
Reference 9. The work covered by this report is shown cross-hatched in the figure and 
includes selection of a test airplane and system concept, design and fabrication of the 
Test ACT System electronic elements, and initial laboratory and flight test planning. 

2.2 TEST ACT TASK OVERVIEW 

The approach to this element of the IAAC Project was to (1) develop the design 
requirements and objectives for a Production ACT System intended to be certifiable in 
the 1990s, (2) develop the system requirements from the design requirements and 
objectives, (3) identify the specific exceptions to the Production ACT System 
requirements that are necessitated by the guidelines in the following paragraph, (4) design 
and build a flightworthy active control system (Test ACT), with fly-by-wire (FBW) 
implementation of pitch axis manual control, and (5) conduct laboratory and flight tests of 
the Test ACT System, with the aim of resolving the technical risks associated with a 
commercial application of this technology. 

The Test ACT System development proceeded under the following ground rules: 

a. The Test ACT System shall implement: 

• Pitch-augmented stability (PAS) 

• Wing-load alleviation (WLA) 

• Fly-by-wire primary pitch control (elevator) 

b. The Test ACT System shall be designed for flight test in the Boeing-owned 757-200 
(NA001). 

c. No change shall be made to primary control surface actuators. 

d. Capability for inflight reversion to mechanical pitch control shall be retained. 

e. The Test ACT System electronics shall be installed in consoles so the equipment can 
be tested in the laboratory and then installed in the flight test airplane with minimum 
disassembly. 
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In the early stages of work on the Test ACT System, Boeing prepared a request for 
proposal on the electronic parts (computers and dedicated sensors) of the system and 
submitted it to the following: 

• Bendix Corporation 

-X. 

• General Electric Company 

-X- 

• Honeywell Incorporated 

• Hydraulic Research 

• Parker Bertea Aerospace 

• Rockwell-Collins Air Transport Division 

• Sperry Flight Systems 

• Teledyne Controls 

• Submitted proposal. 

That was followed by discussions with potential subcontractors, preparation of proposals, 
and selection of the subcontractor, Rockwell International Corporation, Collins Air 
Transport Division. Boeing retained responsibility for the overall system architecture, 
mechanical modifications, and additions to the test airplane; installation of the system in 
the test airplane; laboratory test; and flight test. The electronics system design and 
evaluation were shared between Boeing and the subcontractor. In the accomplishment of 
this work, Boeing and Collins have operated as an integrated team; this report describes 
the product of that team effort, with no special attention given to the division of 
responsibilities between the prime contractor and the subcontractor. 

This report covers the design, development, and fabrication of the system, up to the start 
of laboratory testing at Boeing. 
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3.0 SYMBOLS AND ABBREVIATIONS 


3.1 DEFINITIONS 

In this report certain common words are given special meaning that is not contained in 
their dictionary definitions. These singular usages are defined below. The first two are 
adjectives that categorize the flight safety implications of control functions. 

Critical — any function whose loss can result in a potential hazard, avoidable by 
appropriate pilot action. 

Crucial — any function whose loss can result in an immediate, unconditional flight 
safety hazard. 

The following two terms are used here as names of function categories and of 
corresponding controllers and control elements, such as computers. 

Essential — those functions and control elements that are crucial; they must be 

t 

operating if safe flight is to continue. 

Primary — those functions and control elements that are critical; their loss is not 
necessarily threatening to flight safety but would normally require revision to the 
flight plan. 

The following definitions distinguish two similar control systems treated in this document. 

Production ACT System — the Active Controls Technology (ACT) control system 
having the same functions as Test ACT and of such design and redundancy as to have 
predicted dispatch and inflight reliability that shall meet the 1AAC requirements 
stated herein. 

Test ACT System — the ACT System that is the subject of this report. Although its 
Primary sensor redundancy is not sufficient to meet the IAAC reliability standards, it 
is sufficiently reliable for flight test and evaluation of anticipated Production ACT 
problem areas. 
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3.2 ABBREVIATIONS 


A 

ac 

ACC 

ACL 

ACT 

AED 

AFDS 

ALGOL 

alt 

A/P 

APP 

ARINC 

C 

CAPS 

CAS 

CDR 

CFT 

eg 

CPU 

CRT 

CRU 

CSEU 

CY 

D/A 

DADC 


ampere 

alternating current 

Active Controls Computer 

accelerometer 

Active Controls Technology 

ALGOL Extended for Design 

Autopilot/Flight Director System 

algorithmic-oriented language 

altitude 

autopilot 

approach 

Aeronautical Radio Incorporated 
Celsius 

Collins Adaptive Processing System 

Control Augmentation System; computed airspeed 

Critical Design Review 

column force transducer 

center of gravity 

central processing unit 

cathode ray tube 

cruise 

Control System Electronics Unit 

calendar year 

digital to analog 

Digital Air Data Computer 
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DAFCL 

dB 

dc 

deg 

DID 

DOF 

DRO 

DTP 

EAS 

EHSV 

EICAS 

EMI 

ESS 

FAA 

FAR 

FBW 

FCC 

FCTR 

f 

m 

FMEA 

FSEU 

FTMP 

FTP 

FY 

g 

gal 


Digital Avionics Flight Controls Laboratory 

decibel 

direct current 

degree of arc 

Design Implementation Document 
degree of freedom 

Design Requirements and Objectives 

Detailed Test Procedure 

equivalent airspeed 

electrohydraulic servovalve 

Engine Indication and Crew Alerting System 

electromagnetic interference 

Essential 

Federal Aviation Administration 
Federal Aviation Regulations 
fly by wire 

Flight Control Computer 
Flight Control Test Rig 
mode frequency 

failure mode and effect analysis 
Flap/Slat Electronics Unit 
fault tolerant multiprocessor 
Flight Test Programmer 
fiscal year 

acceleration due to gravity 
gallon 



GLA gust-load alleviation 

GW gross weight 

h height 

HLL high-level language 

H/W hardware 

IAAC Integrated Application of Active Controls Technology to an Advanced 

Subsonic Transport Project 

I/O input/output 

IRS Inertial Reference System 

IRU Inertial Reference Unit 

K gain 

kn knot 

kN kilonewton 

Ibf pound-force 

LRU line replaceable unit 

LVDT linear variable differential transformer 

M Mach 

MAC mean aerodynamic chord 

MCU modular control unit (ARINC dimension specification) 

MEL minimum equipment list 

MLC maneuver-load control 

M mq maximum operating Mach number 

ms millisecond 

MTBF mean time between failures 

n load factor 

N newton 

Pa pascal 
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PACS 

PAS 

PCU 

PDR 

PFTP 

Q 

Q ss 

% 

RAM 

RFCSHL 

RFSC 

rms 

RSS 

RVDT 

SAM 

SAT 

SCD 

SIFT 

SIMCON 

SPM 

SSFD 

STCM 

S/W 

TAC 

TACP 

TED 


Pitch Augmentation Control System 
pitch-augmented stability 
power control unit 
Preliminary Design Review 
Preflight Test Panel 
pitch rate 

steady-state pitch rate 
calibrated impact pressure 
random-access memory 

Renton Flight Control Systems Hydromechanical Laboratory 

Renton Flight Simulation Center 

root mean square 

reduced static stability 

rotary variable differential transformer 

Stabilizer Trim/Elevator Asymmetry Limit Module (part of CSEU) 

System Acceptance Test 

Specification Control Drawing 

software-implemented fault tolerance 

simulation console 

Stabilizer Position Module 

signal selection and fault detection 

Stabilizer Trim Control Module 

software 

Test ACT Console 
Test ACT Control Panel 
trailing edge down 
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TEU 

UAT 

V C 

v 

GND 

V MO 

V S 

V T 

WLA 

WSI 



A 

r 

d 

x 

a 

a GUST 

r 

0 

CO 


trailing edge up 

Unit Acceptance Tests 

calibrated airspeed; computed airspeed 

speed when on ground 

maximum operating airspeed 

stall speed 

true airspeed 

wing-load alleviation 

work station interface 


3.3 SYMBOLS 


elevator deflection 
elevator command 
stabilizer deflection 
change in quantity 

root-mean-square turbulence intensity 
pitch attitude 
failure rate 
real part 

rms isotropic gust level 
time constant 
roll angle 
imaginary part 
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4.0 REQUIREMENTS 


Early in the Test ACT Program, system requirements were established to govern the 
engineering work. These included requirements of reliability and dispatchability and also 
limitations on what could be done to modify the proposed test airplane. This section is a 
brief summary of those requirements. More detailed requirements are contained in "ACT 
System Requirements" (ref. 10) and a Test ACT Specification Control Drawing. 
Section 4.1 of this document states requirements for a Production ACT System. 
Section 4.2 cites the waivers from Production ACT requirements that apply to Test ACT 
and lists appropriate Test ACT implementation requirements. 

4.1 PRODUCTION ACT SYSTEM REQUIREMENTS 

4.1.1 PITCH-AUGMENTED STABILITY 

The prime objective of the Production ACT System is to enable an airplane to be flown 
with reduced or negative longitudinal static stability. The pitch-augmented stability 
(PAS) function of the Production ACT System shall enable flight with Level 1 flying 
qualities (fig. 4) throughout the flight envelope and design center-of-gravity range. 

4.1.2 WING-LOAD ALLEVIATION 

The wing-load alleviation (WLA) function consists of maneuver-load control (MLC) and 
gust-load alleviation (GLA). Maneuver-load control uses symmetrical deflection of 
outboard ailerons to shift wing loads in the inboard direction and thus reduce wing bending 
moments that result from loads generated during controlled maneuvers. Gust-load 
alleviation generates aileron deflections to reduce wing loads produced by atmospheric 
disturbances. The Production ACT System shall incorporate both forms of WLA. 

4.1.3 PITCH FLY BY WIRE 

Pitch axis fly by wire (FBW) shall be provided in the Production ACT System to enable a 
pilot to control the elevators to maximum positive and negative deflections, with no 
mechanical column-to-elevator coupling and comfortable column feel forces. 


15 



O' 



Figure 4. Revised Cooper-Harper Rating Scale, Annotated 
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4. 1.4 RELIABILITY AND SAFETY 


The Production ACT System shall be designed in accordance with the failure survival 
specifications of the Federal Aviation Administration (FAA) Advisory Circular 25.1309b 
(ref. 11) as follows: 

• Any condition that can prevent the continued safe flight and landing of the airplane 
shall be extremely improbable. This is interpreted to be loss of the Essential System. 

_Q 

Probability of such a condition will be shown by analysis to be less than 10 during a 
1-hr flight. 

• The occurrence of any other failure condition that can reduce the capability of the 
airplane or the ability of the crew to cope with adverse operating conditions shall be 
improbable. This is interpreted to be loss of Primary PAS. Such a probability will be 
shown by analysis to be less than 10 ^ during a 1-hr flight. 

• No single Production ACT System failure shall preclude continued safe flight and 
landing. 

4.1.5 SCHEDULE RELIABILITY 

Schedule reliability is defined as the probability of starting and completing a scheduled 
revenue flight without an interruption chargeable to an aircraft system or component 
primary malfunction (not secondary or consequential) involving cancellations, air 
turnbacks, diverted landings, and delays greater than 15 min. Dispatch reliability includes 
only cancellations and delays greater than 15 min. 

The Production ACT System shall meet the following schedule reliability requirement: 

• Schedule interruptions caused by ACT equipment shall not exceed 65 per 100 000 
departures. 
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4.2 TEST ACT SYSTEM REQUIREMENTS 


The overriding requirements applying to these systems are cited in Section 4.1.4. The 
extreme reliability required of a full authority elevator controller gives rise to 
subordinate requirements, some of which are stated in the following paragraphs as they 
apply to the Test ACT System. The complete statement of requirements for Test ACT is 
contained in the System Requirements document (ref. 10) and several procurement specifi- 
cations. Some of the more fundamental requirement items are given in the following 
paragraphs. 

4.2.1 SYSTEM DESIGN REQUIREMENTS 

The system design applicable to the Test ACT System shall be such that the performance 
requirements of Section 4.1 can be met. The system requirements shall include, but not 
be limited to, the following: 

• The control computers shall provide the system monitoring, redundancy management, 
and reconfiguration required to meet the performance specifications of Section 4.1. 

e The system shall have an automated preflight test capability that determines, in less 
than 3 min, the dispatch status of Test ACT and indicates it to the crew. 

• Preflight test coverage shall be sufficient to meet the inflight reliability and safety 
requirements stated in Section 4.1. 

• System faults detected by automatic tests and monitors shall be automatically stored 
in system memory and readily recalled by maintenance personnel. 

e The system shall incorporate control and display panels enabling the flight crew to: 

• Exert necessary control over the operation and testing of the system 

• Monitor system status and all adjustments caused by faults and automatic 
reconfiguration 

o Make preplanned changes to the system for flight test investigations 
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• The system shall be designed such that a generic software error cannot result in a 
hardover elevator command. 

• The electronics shall be contained in two consoles, each limited to the following 
dimensions: 

• Height 1.3m (53 in.) 

• Length 1.1m (42 in.) 
o Depth 0.8m (32 in.) 

The maximum weight shall be 181 kg (400 lb). 

4.2.2 MECHANICAL DESIGN REQUIREMENTS 

The mechanical backup control requirement and the problems of installing Test ACT into 
an existing airplane create special electrical and mechanical implementation 

requirements. Those of the mechanical category follow: 

• Both mechanical and FBW controls shall be available during flight. 

• The design shall be such that a single disconnect in the elevator linkage will not 

disable more than one elevator. 

• The maximum hysteresis, deadband, and linearity between commanded and measured 
elevator positions shall be in accordance with Figure 5. 

• The feel system parameters and tolerances shall be designed per Figure 6. 
Requirements for force transducers are defined in References 2 and 3. 

• The FBW control column shall be mass balanced so that the column force resulting 
from inertial forces generated by accelerated flight within the design envelope will 
not exceed 13.3N (3.0 lb). The column and its feel system shall be damped to avoid 
column overshoot. 
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Deadband: less than 0.05-deg 8g 

Hysteresis: less than 0.1-degS E 

Total Position Error: less than 0.15-deg 8 E 

Nonlinearity: less than 2% w 
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Figure 5. Hysteresis, Deadband, and Linearity Requirements-FBW Mechanical Path 


Implementation of PAS and pitch FBW in accord with the above statements necessitates 
redundant elevator secondary servoactuators. Requirements applying to those 
servoactuators include the following: 

• The actuators have the authority to drive the power control units (PCU) and the 
elevators to 30-deg trailing edge up and 20-deg trailing edge down. 

• Maximum no-load surface rate is at least 55 deg/sec. Electrohydraulic valve 
characteristics are the same as those of the current 757 rollout guidance actuator, 
modified as required for increased flow. 


e Torque output of each actuator is such that no more than two actuators are required 
to handle all anticipated loads, including jam override capability. 
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Figure 6. Control Column Feel System Requirements 

• When connected in a control loop with a loop gain of 30 rad/sec, the secondary 
actuator meets the stability, frequency response, null shift, and hysteresis 
requirements of the existing 757 rollout guidance actuator. 


Requirements are not stated for aileron secondary servoactuators. Only electronic WLA 
commands will be evaluated during flight testing; i.e., actuator commands will be 
monitored but not routed to control surfaces. 


4.2.3 ELECTRONIC DESIGN REQUIREMENTS 


The design and fabrication requirements of the electronic parts were imposed to ensure 
adequate reliability. These requirements are as follows: 
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• Materials and processes employed in the design of the equipment shall be consistent 
with those approved for the 757/767 Autopilot/Flight Director System. 

• The design of the equipment shall be adequate to ensure operation within the design 
limits during and/or after exposure to altitude, temperature, vibration, and g loads 
applicable to 757/767 airplanes. 

• The equipment shall operate properly when supplied with power of 757/767 standards. 

• The computer power supply shall operate from either or both of two 28V dc power 
sources. The power supply shall provide seven dc-regulated voltages for logic circuits 
and two semiregulated single-phase 400-Hz ac sources of power required to excite 
system sensors. 

• The power supply shall sustain all loads during zero power input from both sources for 
a period of 50 ms. Current sensing of each source to the power supply shall ensure 
both a limit on initial inrush of current and a current balance between the two 
sources. 

O The system wiring shall be designed to minimize susceptibility to electromagnetic 
interference. 

9 Connector and wiring separation between channels and circuit segregation on the 

printed circuit boards shall be retained to prevent a short from resulting in the 

failure of the system to perform its design functions. 

O The software design procedures shall be consistent with 707/727/737 software 
standards. 

• The software shall be verified by functional test, functional walkthrough, and module 
inspection. 

e The control computers shall have the speed and capability required to perform in real 

time all calculations required to implement simultaneously the control laws, 

monitors, and redundancy management functions. 
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5.0 SYSTEM ARCHITECTURE 


This section identifies the main features of the Test ACT system architecture and relates 
their choice to the critical issues faced in the system design. 

The system mechanizes flight-crucial pitch axis stability augmentation and fly-by-wire 

(FBW) longitudinal control; hence the pitch control system must have a probability of 

-9 

total function loss of less than 10 in a flight of 1-hr duration. It also mechanizes wing- 
load alleviation (WLA), speed stability augmentation, and elevator offload functions 
requiring a function loss rate less than 10""'’. These facts yield the critical issues of the 
system architecture and result in the features described below. 

5.1 ARCHITECTURE ISSUES 

In the course of work by the Boeing-Coilins team toward selection of the system 
architecture, the following items were identified as issues of prime importance: 

• What redundancy management plan, system elements, and interfaces will serve to 

_Q 

achieve a probability of function loss less than 1x10 in a 1-hr flight? 

• What redundancy level is required to preserve airline schedule reliability? 

• What system architecture will minimize susceptibility to generic hardware and 
software faults? 

• What monitors can be allowed to shut down a channel of crucial function control? 

• Assuming a two-level system, composed of Primary and Essential computer sets: 

• Is switching between levels allowable? 

• In which level is preflight test performed? 

• Are both levels full authority? 

• How should the Essential part be implemented: 
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Digital or analog? 

Cross compared or "brick walled"? 

Sensors dedicated or shared with the other level? 

• Can gain variation be allowed in the Essential set? 

• Should digital computer operation be synchronous or asynchronous? 

• Should preflight test be automatic or manual? 

• What are the system voting planes? 

These critical issues are discussed later in this section. A number of lesser issues arose in 
the system design process, including these: 

• Should redundant Primary system sensors be connected one-for-one with the 
computers, or "cross strapped"? 

• Shall the system when "down moded" (reduced in redundancy by apparent component 
fault) be allowed to "up mode" if component recovery occurs? 

o How much redundancy is needed in the servoactuator shutdown function? 

• Must there be an Essential channel oscillatory failure monitor? 
e What servoactuator tests are needed? 

• What down-mode strategy is employed? 

e How is preflight test of the analog channels accomplished? 

These and other design decisions are addressed in Section 5.1. 
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5.1.1 RESOLUTION OF CRITICAL ISSUES 


_Q 

Functional Partitioning— The challenge of the 10 function loss has been a key feature of 
the IAAC Project since its inception. Early in the project, it was determined that an 
integrated active control system, using a single set of redundant digital computers serving 
all functions, was better than a segregated one using a separate computer set for each 
function. The digital computer served admirably to combine in one machine the diverse 
operations of control law computation, self-test, monitoring, voting, and redundancy 
management. On the other hand, the computer's complexity raised serious doubts that it 
could be made to meet the specified reliability. In light of that, the principle of 
partitioning by criticality of functions was applied and has been retained in all project 
phases, including Test ACT. Since fly by wire is a beneficial function with the same 
criticality as that of pitch augmentation, it was added as a functional requirement; but 
the less critical WLA and speed stability augmentation are kept separate from the 
Essential pitch control system. This functionally partitioned approach ensures that a less 
critical function cannot compromise the safety of a crucial function and thereby reduces 
risk. Functional partitioning therefore was an early architectural decision. 

Digital Primary— For the Primary system, the versatility and computation power of the 
digital computer were judged necessary. The interface with digital state sensors (air data 
and inertial) is easier and more reliable with digital computation. Also, redundancy 
management and built-in test requirements make digital capability almost mandatory. 
This left open the question of what was to serve as the ultrareliable backup system, now 

_9 

called the Essential system, for the functions requiring the less than 10 probability of 
function loss. 

Backup System— The requirement for crucial function reliability is a probability of loss of 

_9 

function less than 10 in a 1-hr flight. Based on the projected reliability of components 

such as sensors, computers, and actuators, an Essential system that could survive two 

similar failures (fail op ) was required. The next decision was that the fail op fault 

tolerance requirement would be met with a four-channel (quadruple) system. While a 

2 

three-channel system can be fail op if sufficient inline monitoring is provided, that 
introduces the major risk of uncertainty in providing and proving coverage for the second 
fault. The quadruple concept avoids this risk by detecting all faults by either voting or 
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comparison monitoring. This approach is widely accepted as providing essentially 100% 
coverage. The penalty of this approach is the cost of the fourth channel and supporting 
systems such as electric and hydraulic power. 

Protection Against Generic Faults— A major issue to be addressed was the generic fault 
problem. How do you prove to the required extreme confidence level that a software 
error or latent fault cannot result in failure of all redundant channels? Solutions to this 
problem take two forms: (1) fault avoidance by vigorous design and test and (2) fault 
tolerance. The next major architectural decision was that Test ACT would be designed to 
tolerate generic faults. The basic way to survive a generic error is to provide dissimilar 
redundancy. 

Several quadruple, dissimilar, standby computer concepts were developed using both 
digital and analog computers for the standby system. They used the basic principles of 
generic fault detection by reasonableness or "red line" monitoring (ref. 12) and also 
generic fault isolation by switching control from the failed digital computer set to a 
dissimilar system providing "get home" capability. Since the airplane may be 
longitudinally unstable, it was assumed that the pilots could not perform the switching 
operation; it would have to be computer controlled. 

This concept was examined in depth. Aside from the obvious implementation complexity 
and some concern over generic faults such as lightning that could disable all digital 
computers, the primary technical issue emerged as a lack of confidence in the switching 
function. For example, what sort of monitor can, with extreme reliability, detect generic 
faults? And how do you know that the standby system is working when it is used only 
under extremely rare conditions? 

The Collins proposal addressed the switching dilemma with a concept based on the 
following premises. First, simple analog systems can be designed and tested to be immune 
to generic faults. Second, the "simple" analog computer (supported with dedicated, high- 
reliability, feedforward and feedback sensors) can do all crucial functions operating 
continuously and provide at least "get home" flying qualities. The plan uses digital 
Primary computers with additional feedback variables and gain scheduling to provide 
additive control commands, yielding very good handling qualities for normal conditions. 
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Digital command authority is limited by the analog computer such that even a hardover 
generic digital fault is fail-safe (failure transients kept below passenger injury or 
structural damage levels). The digital computers also perform most of the test and 
monitor functions. 

Essential System Monitors— The concept just described is founded upon simplicity of the 
analog Essential channel, a low channel failure rate (MTBF more than 10 000 hr), and 
careful avoidance of any path by which failure of one channel can contaminate another 
channel. Cross-channel communication was found to be incompatible with these objec- 
tives; the Essential system has to be "brick walled"; i.e., the channels are isolated from 
one another through all electric paths. This requires that all monitoring is done in line 
rather than cross channel; and all input voting must be performed individually in each 
channel. This leads to the questions of what monitors in the system are "executive" (i.e., 
able to shut down an Essential channel) and where are the voting planes of the system in 
general. 

The monitor philosophy is based on the same rationale that led to the choice of brick- 
walled analog Essential control computers; namely any executive monitor must be simple, 
analog, and in line. Thus the executive monitors are all in either the power supplies or in 
the Essential computers and comprise the power monitor, the LVDT common mode 
monitors, the rate gyro spin monitor, and the servoactuator detent monitor. 

Voting Planes— The choice of voting planes was aimed at promoting reliability by 
minimizing the impact of failed components. Inputs to the Primary digital system are 
obtained from autonomous input/output circuits and communicated cross channel such 
that a failed central processor does not deny its sensor input signal to other channels. 
Primary elevator commands are voted in the Essential analog computer, as are the three 
flap position discrete inputs, so that the brick-walled analog channels all see the same 
values for those inputs. The ultimate voting plane is the secondary servoactuator 
summing shaft— the final system output. Here the four Essential channel signals are force 
voted. The detent of a failed channel actuator is overcome by the other three actuators 
in the first failure case, or by the other two in case of a second failure. If the detent 
offset exceeds 2.5-deg equivalent elevator deflection for 3 sec, the servoactuator detent 
monitor disengages the failed channel. 
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Primary Redundancy— Earlier IAAC studies indicated that the critical function probability 
of loss rate less than 10 - ^ in a 1-hr flight can be met with a three-channel Primary system 
architecture. That requires that all three channels are available for dispatch, a 
stipulation which would affect schedule reliability. The preferred solution, given that 
four electric power supplies are already needed for the Essential system, is a quadruple 
Primary system that may be dispatched with one channel down. 

Preflight Test— Meeting the prescribed reliability levels of the Primary and Essential 
systems requires a certain known availability level of redundant channels at takeoff. The 
Primary system must have three of the four channels available, and the Essential system 
all four. Knowing this requires a thorough preflight test before each departure. How 
should preflight test be performed? If it is automatic, where is its control lodged? 

Early IAAC system studies yielded these conclusions: 

• Preflight test should not add significantly to the time now required for the cockpit 
preparation routines of a commercial airliner. 

• It should add little or nothing to the work required of the pilot. 

Corollary conclusions were that preflight test should require no more than 2-min elapsed 
time and should be automatic to the maximum practical degree. 

In proceeding with detailed specification of Test ACT preflight test, the design team 
observed that a small measure of flight crew participation is needed. The crew should 
initiate the test so that it may be done at a convenient and appropriate time; and, since a 
complete checkout includes control surface motion, the crew must ascertain airplane 
ground clearance before that part of the test occurs. These factors led to the design 
decision to automate preflight in two stages, each initiated by a pilot. The first is an all- 
electronic part, called "Passive"; the second, involving control surface motions, is called 
"Active" and calls for a pilot's application of fore and aft forces on the control column. In 
all other respects, preflight test is conducted automatically; assuming the pilots respond 


28 



promptly to indications requesting "Start Active," "Pull Column," and "Push Column," the 
complete test requires less than 2 min. 

The preflight test sequence is of sufficient complexity such that it could not be done in a 
simple analog computer; it must be controlled in the Primary system. This requires 
special care in testing Essential analog functions to preserve the "brick walled" character 
of Essential channels. This is achieved by allowing the crucial functions of an analog 
channel to be interrogated by only one Primary. 

Essential Gain Variation— From the point of view of preserving simplicity of the Essential 
computer, it is clearly desirable that it operate in all flight modes at constant gain. It 
soon becomes evident that the Primary elevator command limit of 2.5 deg, chosen to limit 
hardover response to lg normal acceleration in 3 sec under cruise condition, would not 
allow the system to produce Level 1 handling qualities at low speed. This made two limit 
levels, and a high-reliability means of switching between them, necessary in the Essential 
system. The switching requirement was met by means of voting among three available 
"flaps down" discrete signals, and using the voted discrete to change the limit from 7 deg 
at low airspeed to 2.5 deg at high airspeed and vice versa. Given this reliable speed 
change signal, it was practical to solve the low-speed/high-speed problem in the Essential 
control laws by switching gain in the feedforward and feedback paths while keeping the 
low-gain (high-speed) line continuous in both circuits. In the transition to low speed, the 
flap discrete brings in additional gain. 

Asynchronous Primary Computers— Asynchronous operation of the redundant digital 
computers was chosen for this application. Low bandwidth inputs and high sampling rates 
minimize the time offset disadvantage of asynchronous operation. The wide fault 
threshold normally characteristic of asynchronous operation is not needed here because 
the digital signals are not isolated by comparison monitoring. Asynchronous operation 
also avoids the synchronizer as a possible single-point failure source. The option of 
synchronized computer operation for future tests was retained by designing and including 
a synchronization circuit card in each computer box. 
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5.1.2 SUMMARY 


Architecture merits that resulted from the evolution described previously are as follows: 

• The system can survive a worst case generic digital fault. 

• The system can tolerate any two similar failures with no reduction in performance. 
(Because of the voting planes, even greater tolerance for dissimilar failures is 
provided.) 

• The high-reliability analog portion of the system is always "on line" and requires no 
switching. 

• Digital computers are used for their unique control law and redundancy management 
capability. 

o The concept provides very high fault isolation coverage. 

In summary, the selected system is hybrid and combines the safety of simple analog 

computers with the performance and versatility of digital computers. 


5.2 TEST ACT CONFIGURATION 

The Test ACT System Configuration is shown in Figure 7. Test ACT is separated by a 
heavy dashed line from airplane equipment with which it interfaces. The redundancy 
limitations of the Primary system, described in Section 4.2, are shown in the boxes 
representing 757 sensors at the left and the trim system at the bottom of the figure. 
Note that the Essential sensors for column force and dedicated pitch rate are quadruple. 
(The term "dedicated" distinguishes the quadruple pitch-rate gyro inputs from the lower 
reliability Primary pitch-rate signals coming from triple Inertial Reference Systems 
(IRS)). 

The general arrangement of Figure 7 is conventional for control systems; i.e., in general 
sensors are situated at the left, the computers in the center, and the servoactuators at 
the right side. An exception is the placement of the dedicated pitch-rate sensors in the 
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Figure 7. Test ACT System Block Diagram 






middle of the Test ACT System part of the diagram, just above the Essential analog 
computers. The autopilot Flight Control Computer (FCC) and the Control System 
Electronics Unit at the bottom of the diagram are both control computers that are part of 
the existing test airplane equipment. Control and display panels and the system console 
are in the Test ACT System box at the upper left. For the sake of diagram clarity, all 
redundant connections, whether dual, triple, or quadruple, are represented by single lines. 

5.2.1 ESSENTIAL SYSTEM 

The part of the Test ACT System that must perform with extremely high reliability, as 
discussed in Section 5.0, is the Essential system, comprising the column force sensors, 
dedicated pitch-rate sensors, Essential analog computers, and elevator secondary 
actuators. This is the quadruple, simple, brick-walled, high-reliability system that always 
operates to provide acceptable airplane handling characteristics in the pitch axis, 
regardless of center-of-gravity location. The FBW function is generated by the column 
force sensors and a simple, dual-gain feedforward control law in the analog computers 
coupled to the elevator servos. Short-period pitch stability augmentation is provided by 
the pitch-rate gyros and a simple dual-gain feedback control law. Both of those control 
functions are available for safe flight if the entire Primary system fails. In normal 
operation those controls are supplemented by Primary system commands to provide 
Level 1 flying qualities in pitch. By keeping the Essential system very simple and free of 
elaborate gain schedules and reconfiguration provisions, the estimated reliability meets 
the requirement quoted in Section 4.1.4. 

5.2.2 PRIMARY SYSTEM 

The Primary system utilizes the airplane sensors shown at the left in Figure 7 plus the 
wing accelerometers, the quadruple Primary digital computers, and the airplane trim 
system to perform the functions of speed stability augmentation, elevator offload, and 
wing-load alleviation. As shown in the diagram, the wing-load alleviation function is 
carried through computation of the servo command, which is monitored and made part of 
the redundancy management process in the computer; but no aileron secondary servos are 
installed and hence there is no airplane response to that function. Since autonomous input 
processing is provided to preserve sensor redundancy in the event of Primary central 
processor failure, the sensor-to-computer coupling plan is fundamentally one-for-one. 
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The test airplane's shortage of Primary sensors requires that limited cross-strapping be 
employed to serve each computer with direct coupling to a complete sensor set; for 
example, the center IRS is connected to two Primary computers. 

The Primary system also contributes to short-period pitch augmentation and the fly-by- 
wire feedforward control law; for the latter it requires column force sensor input. For 
the Primary computers, that column force signal is supplied from the Essential computers; 
this is done for reliability reasons. Column force is a buffered output from the Essential 
computers to the Primary, so that a catastrophic failure in the Primary input system 
cannot affect the Essential column force input. That scheme also saves one set of 
demodulators. 

The Primary computer is a minicomputer derived from the Collins FCC 701, the 
Autopilot/Flight Director System computer for the Boeing 757 and 767 airplanes. Its high 
throughput and memory capacity enable it to be programmed for these diverse functions: 

• Control laws for the active control and fly-by-wire functions listed above 

• Primary system redundancy management and reconfiguration control 

• Preflight test of the complete Test ACT system, including the Essential channels 

• Self-test and self-monitor functions 

• Sensor signal selection and failure detection 

• Flight crew communication and control via three flight deck panels 

• Simulated maintenance interface via the Test ACT Console 

Redundancy management design issues include such questions as the down-mode strategy 
for sequential failures in sensor sets; the choice made for Test ACT is "4-3-2-0"; i.e., no 
operation on a sensor signal is allowed if only a single valid input is available. This relates 
also to the question of whether or not sensor upmode is allowed; the answer is a qualified 
"yes," requiring a renewed valid signal from both inline monitor and comparison monitor. 

Preflight test control is another large assignment for the Primary computer. Since the 
ultimate voting plane is the detent vote at the actuator force summing shaft, proper 
detent operation is crucial and a "soft detent" test must be a part of preflight. This 
requires that three Primary computers disengage their respective Essential servoactuators 
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while the fourth Primary tests its associated actuator detent. Two solenoid valves in 
series provide redundant capability for servo shutdown. The detent comparator includes a 
means of Essential channel oscillatory failure detection. 

The "Test ACT Console" block in Figure 7 represents the Test ACT System structure. In 
the laboratory, the console is the housing and mounting for all of the system except the 
servos; in the test airplane it carries all of the system except the servos, the system 
sensors, and the three flight deck panels. This arrangement minimizes the 
interconnection changes needed in the move from laboratory to airplane. 

The connection from the Flight Test Programmer to the autopilot FCC is a discrete signal 
to (1) disable the cruise autopilot computer when Test ACT is operating and (2) engage the 
autopilot actuator as a detent in the Test ACT series summing linkage. That signal passes 
through the ACT STATUS switch, the element by which the pilots can promptly disable 
Test ACT and revert to mechanical control of the pitch axis. In such case, the single- 
channel cruise autopilot also becomes available. Because Test ACT employs two autopilot 
servo positions in the test airplane, the multiple-channel autoland autopilot is not 
available. 

A single line is employed in Figure 7 to indicate one of the system's most important 
features; i.e., when Test ACT is operating the elevator secondary actuators are always 
under the control of the analog Essential computers. 

5.3 OPERATION MODES 

The operational modes sequence (fig. 8) represents normal operation of a production 
system. A few seconds after electric power is applied to the system, the automatic 
power-up test sequence is completed, the "NO GO" status indicator on the preflight test 
panel is illuminated, and the "PRESS PASSIVE" message appears to the crew on the Engine 
Indication and Crew Alerting System (EICAS). A pilot then initiates the passive preflight 
test by pushing the "PASSIVE" button on the preflight test panel. (The "PASSIVE" term 
refers to the fact that there is no control surface motion during this first portion of 
preflight test.) The PASSIVE test sequence, requiring less than 30 sec, is described in 
detail in Section 6. 3. 1.2. In the absence of faults, the end of this sequence is signified by 
the appearance of an illuminated "ARM" indication in the pushbutton for the active test 
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Figure 8. Test ACT System Operational Modes 













sequence on the Preflight Test Panel. When the pilots have verified airplane ground 
clearance, they can initiate the active phase of preflight test involving the motion of 
control surfaces. This phase, also described in Section 6. 3. 1.2, requires a pilot to pull and 
push the control column in response to appropriate crew prompt messages displayed upon 
EICAS. Assuming no failure has been encountered, this test phase ends with the 
appearance of the green "GO" indication on the Preflight Test Panel. The complete 
preflight test series requires less than 2 min. 

The system now is in takeoff status; the Essential system is in operation, but Primary PAS 
and WLA are inactive to ensure that they do not cause undesired response to accelerations 
encountered in ground taxi and rolling. Since the flaps are down in a takeoff position, the 
Essential system is on its high gain setting. During the takeoff roll, when airspeed 
exceeds 26 m/sec (50 kn), preflight test is locked out. At liftoff, Primary PAS and WLA 
are activated through "EASY ON" circuits such that they do not inject a step signal into 
the control surface actuators. During climb, when the flaps are fully retracted, the 
Essential and Primary systems are switched to the low gain setting; this status will be 
maintained until the approach to landing when the airplane is again at low speed, flying 
with flaps down. As the airplane touches down in the landing phase, Primary PAS and 
WLA are deactivated, again to prevent undesirable control surface motions in response to 
ground accelerations. As the airplane slows down to 21 m/sec (40 kn), preflight test 
becomes available so that the system can immediately be prepared for the next flight leg. 

In the early stages of Test ACT flight test, takeoff and landing will be done with positive 
pitch stability and with the system deactivated. In such cases, preflight test will be run; 
then prior to takeoff, the servos will be disengaged by means of the ACT STATUS switch 
on the Flight Test Programmer (sec. 6. 3. 1.3). 

5.4 CONTROL LAWS 

The control laws implemented in both digital Primary and analog Essential computers are 
shown in Figures 9, 10, and 11. They are tailored to the test airplane and to the 
operations plan shown in Figure 8. Since the Primary computer is digital and the Essential 
computer analog, the column force detent is implemented in both forms and shown in 
Figure 9 in both machines. Analog-to-digital and digital-to-analog converters are not 
included in these diagrams. The "Easy On/Off" blocks shown are provided to ensure that 
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discrete switching functions occurring at operation mode changes such as Jift-off, flaps 
up, and flaps down do not introduce step changes in elevator command. 

Control law synthesis is described in Section 10.2. 

5.5 HARDWARE CONFIGURATION 

5.5.1 ELECTRONIC HARDWARE 

The Test ACT System electronic hardware is shown in Figure 12. It includes all of the 
Collins-supplied elements of the actual control system except the wing accelerometers. 
On top of the computers in that photograph are three control and display panels that will 
be installed in the test airplane flight deck. Figure 13 provides a closer view of these 
panels. The Flight Test Programmer (FTP), occupying the center panel in that figure, is 
needed in the Test ACT System only; the Test ACT Control Panel (TACP) and the 
Preflight Test Panel (PFTP) would have counterparts in the Production ACT System 
installation. 

Figure 14 shows the Test ACT Console (TAC), which houses the control system 
electronics, plus the equipment for controlling and communicating with the system in 
laboratory and flight test operations. The TAC is shown in its laboratory test 
configuration; the column force sensors are mounted on top of console No. 2, with a lever 
for force application. The three flight deck panels are installed at the upper right in 
console No. 1. The Active Controls Computers (ACC) occupy the left half of console 
No. 2, and the balance of the equipment provides means of instrumenting system 
conditions, loading and reading software, simulating faults, controlling power supplies, and 
conducting other test operations. 

5.5.2 MECHANICAL HARDWARE 

Mechanical modifications to the airplane affect two subsections of the pitch control 
system, located under the flight deck floor and aft of the pressurized cabin. Those 
modifications have been designed; they are described and illustrated in Section 8.0 and 
Appendix D. 
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Figure 12. Test ACT Electronic Hardware 
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6.0 SYSTEM DESIGN: ELECTRONIC HARDWARE 


Figure 7, the block diagram of the Test ACT System as a whole, is a good aid in 
recognizing the interrelationship of the diverse elements described in the following 
paragraphs. 


6.1 COMPUTERS 

The Test ACT System employs two control elements: the Primary digital computer and 
the Essential analog computer. These two computers are housed in one chassis to make 
use of existing equipment and to avoid the added cost and development time of a new 
chassis. The 757/767 Flight Control Computer (FCC-701) forms the framework, but the 
delivered unit is called an Active Controls Computer (ACC), as shown in Figure 15. 

The ACC represents a high-technology design that provides for a flexible implementation 
of the Test ACT requirements. It is partitioned into 19 circuit cards, 3 interconnect 
cards, and a power supply packaged in an 8-MCU assembly, as shown in Figure 16. The 
hardware is divided into functional elements to meet the requirements of safety 
segregation, hardware tasks, and module testability. 

Circuit segregation, a very important consideration in the hardware design, is accom- 
plished by use of card boundaries and component isolation within the card. Major 
functional elements are located on individual cards, providing, when feasible, a natural 
separation. Where there are several redundant functions per card, components are 
physically segregated as much as possible. 

6.1.1 PRIMARY COMPUTER 

Figure 17 shows the partitioning of the Primary and Essential computers in the ACC. The 
Primary computer is designed around a dual-bus architecture, consisting of a high-speed 
computer bus (transfer bus) and a dedicated input/output (I/O) bus. 

The I/O bus is managed by the I/O controller, which handles the transactions for serial 
input/output data, discrete inputs, and analog inputs. Five circuit cards interface with 
this bus: the I/O data path card, the I/O control card (both of which make up the I/O 
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Figure 15. Active Controls Computer - Cards A6, A8, A9, A12, and A20 Removed 
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Figure 16 . ACC Circuit Cards Placement-Top View 
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Figure 17. ACC Block Diagram-Partitioning Primary and Essential Functions 
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controller), the analog input card, the digital/discrete input card, and the Aeronautical 
Radio Incorporated (ARINC) 429 I/O card. Transactions that take place via the I/O bus 
are independent of the central processing unit (CPU). 

However, the CPU, which consists of control and data path circuit cards, manages devices 
that interface with the transfer bus. Ten peripheral cards are tied to this bus and are 
under control of the CPU. They provide the functions of: 

• Program memory 

• Read-write memory 

• Servo interfaces 

• Computer timing 

• Wing-load alleviation (WLA) engage arm and trim logic 

• Pitch-augmented stability (PAS) and WLA caution and warn outputs 

• System monitoring 

• Cross-channel data reception 

• Synchronization 

• Bus termination 

The basic architecture of the Primary computer is the same as that of the FCC-701. This 
is very important to the Test ACT Program in that it provides the low risk of a known, 
working digital system. It also allows the use of existing development tools, such as the 
Collins Adaptive Processing System (CAPS) Test Adapters, from the Autopilot/Flight 
Director System (AFDS) Program. Additional expense is avoided by using existing 
software tools, such as the ALGOL Extended for Design (AED) compiler and link editor, to 
change the AED source code to the CAPS relocatable object code. 

6.1.2 ESSENTIAL COMPUTER 

The Essential analog portion of the ACC has two main functions: computation of the 
Essential control laws and the warning and engage logic. As shown in Figure 17, the 
Essential control law functions are distributed between two cards. Essential No. 1 (card 
A6) contains the pitch-rate and column force input filtering and control law 
implementation, including flap position gain switching. Essential No. 2 contains the 
Primary command signal selection and the servo amplifier electronics. ACC card A9 
contains the Essential warning and engage electronics. 
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The Essential control laws are implemented with analog circuitry. Certain gains and 
filters have been identified as candidates for change during the laboratory test and flight 
test program phases. For these, the mounting of the resistors and capacitors has been 
arranged to allow replacement of the components without damage to the printed circuit 
boards. 

6.1.3 POWER SUPPLY 

Early in the development of the ACCs, it was determined that the FCC power supply, 
with its single ac power source, did not have sufficient reliability to serve as the ACC 
power supply. In order to meet the Test ACT reliability requirements, dual airplane 28-V 
dc power sources for the power supply module were needed. This power supply module is 
designed to perform satisfactorily with either dc source unavailable. 

The power supply module, supported by the aircraft power system, supplies all voltage 
necessary to power the ACC and to provide excitation and/or power for the system 
sensors of the Test ACT System. 

Because of space limitations in the FCC chassis, it was not possible to incorporate 
independent power supplies for the Primary and Essential computers. The resulting single 
supply module was designed to serve both and still fulfill the requirements imposed on an 
independent Essential supply, which are: 

0 To provide regulated power to the computers 
e To provide 26-V ac, 400-Hz sensor excitation 
e To provide 115-V ac, 400-Hz power for the rate gyros 

The FCC power supply, fed by 115V ac, 400 Hz, has two major sections: a primary ac-to- 
dc power converter and a secondary stepdown, dc-to-dc voltage regulator. For the ACC- 
regulated power requirement, the primary section was replaced by two step-up, dc-to-dc 
power converters; the secondary section remained the same. To fulfill the sensor 
excitation requirement, a new dc-to-ac power converter design was required. 

Because power supplies of the "switching regulator" type are inherently noisy in terms of 
electromagnetic radiation, the power supply module design incorporates shielding and 
electromagnetic interference (EMI) filters to alleviate the problem. The completed 
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design was subjected to Collins' standard qualification testing (based on Radio Technical 
Committee for Aeronautics document, DO- 160, ref. 13) to ensure that radiation did not 
exceed acceptable limits. The design was also tested for electromagnetic susceptibility 
over the ambient temperature range and was found to be acceptable. 

Avionics systems typically monitor the power supply and use power status information in 
engage, annunciation, and other decision logic. To aid in evaluation of system response to 
Primary and/or Essential power failures, the "power valid" signals for the Primary and 
Essential computers have been kept independent. 

6.2 SENSORS 


6.2.1 SYSTEM SENSORS 

The Test ACT System employs redundant system sensors, shown inside the dashed box of 
Figure 7, as well as airplane sensors (sec. 6.2.2) already installed in the test airplane. The 
system sensors serving the Essential computers are pitch-rate gyros and control column 
force transducers; those for the Primary computers are wing accelerometers. 

A rate gyro generates an analog output proportional to the angular rate of change about a 
specified axis. In the Test ACT application, the pitch-rate gyro measures the airplane 
angular rate about the lateral axis and provides a two-wire analog output used as feedback 
in the Essential PAS short-period stabilization loop. 

The control column transducers issue an ac voltage proportional to the applied force used 
in the Essential fly-by-wire (FBW) function. 

The accelerometers produce an analog output proportional to the acceleration along the 
axis that is perpendicular to the mounting surface. In Test ACT, the accelerometer 
measures the acceleration of the outboard wings normal to the reference plane and 
provides an input to the gust-load alleviation (GLA) function control law. 
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6. 2. 1.1 Pitch-Rate Gyros 


In the Test ACT System, the pitch-rate gyro is a combination unit composed of a 
miniature rate gyro attached to a mounting base that contains electronics for self- 
monitoring and preflight test. This assembly is shown in Figure 18. The rate gyros are 
Smith's Industries 719S-9 air-bearing gyros. Their predicted mean time between failures 
(MTBF) is greater than 20 000 operating hours and has been confirmed in service. 



Figure 18. Pitch- Rate Gyro 
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Operating experience to date indicates that the most probable gyro failure mode is motor 
failure to start. To detect this mode, a dedicated spin monitor in the mounting base 
senses phase lock of the rotor and stator. A rotor that is not spinning at proper speed will 
be out of synchronism and will be detected. Because a slow or nonspinning rotor is a 
passive failure of the sensor (i.e., it is not observable at the analog output until a pitch 
event occurs), the monitor state is provided as discrete output. In the Test ACT Program, 
this discrete is used by the Essential computer as a condition in the Essential servo engage 
logic. 

A torque coil is installed on the gyro to allow a ground check of the precession sensing 
mechanism. By means of a test circuit in the mounting base, the rate gyro may be 
commanded to produce an output equivalent to a known value of pitch rate. Proper 
response to the torque command indicates proper operation of the gyro output provisions 
downstream of actual gyroscopic precession. This response is not affected by rotor speed; 
it is no substitute for the spin monitor described above. 

6. 2. 1.2 Control Column Force Transducers 

The column force transducer (fig. 19) is constructed by Kavlico to Boeing 757 aircraft 
drawing S253T401, with changes that provide four independent electrical outputs per 
transducer. 



Figure 19. Column Force Transducer 
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The linear variable differential transformer (LVDT) force transducers do not include 
monitoring or self-test provisions. Their outputs are three wire, which allow user 
monitoring of open or shorted signal paths. Check of the actual force sensing will be 
accomplished by a ground check force on the control column. 

6. 2. 1.3 Wing Accelerometers 

The wing accelerometer (fig. 20) is a dc analog unit purchased from the Systron-Donner 
Corporation and packaged per Collins specifications. It does not include monitoring or 
self-test provisions, but the nominal 1-g output due to gravity provides a convenient 
method of checking accelerometer operation. The unit has a predicted MTBF of 60 000 
operating hours, supported by field data on 1 year of service. 



Figure 20. Accelerometer 


6.2.2 AIRPLANE SENSORS 

This section discusses those airplane sensors used in the 757-200 production configuration. 
The sensors are connected to the Test ACT computers as shown in Figures 21 through 24, 
and their signal and discrete information is utilized in the control laws, as shown in 
Figure 25. 
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Sensors 



Figure 21. Airplane Sensors 


6.2.2. 1 Inertial Reference System 

There are three Inertial Reference Systems (IRS) on the 757. These strapdown systems 
use laser gyros, accelerometers, and digital computation to determine the airplane pitch, 
yaw, and roll attitudes and rates; accelerations; and speeds. This information is 
transmitted over an ARINC 429 bus. 
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Figure 22. Primary Sensor Interface 


Pitch, yaw, and roll attitude and pitch-rate information are fundamental parameters in 
the Primary control laws, whereas body normal acceleration is used in the WLA control 
laws. The information from all three IRSs is available to each of the four ACCs via the 
cross-channel buses. 

IRS connections are shown in Figures 21 and 22; signal routing is shown in Figure 25. 
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Figure 23. Hap Position Discrete Signal Interface 
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6.2.2.2 Digital Air Data Computer 

Impact pressure and static pressure are measured by means of pitot-static probes on the 
aircraft. The Digital Air Data Computer (DADC) then transforms the pressure signals 
into digital information and computes airspeed, Mach number, altitude, and rate of climb. 
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Figure 25. Airplane Sensor Signal Distribution 


There are two DADCs on the test aircraft, information from which is transmitted via an 
ARINC 429 bus to two ACCs, as shown in Figure 22. 

Impact pressure is used in the WLA and Primary PAS control laws for gain scheduling, 
while true airspeed is the feedback variable employed for speed stability in the Primary 
control laws. 


59 
















6.2.2.3 Flap Position System 


The flap position system is part of the 757 high-Jift control system. Its information is 
derived from synchros and resolvers located on the inboard and outboard trailing-edge 
flaps. The Flap/Slat Electronics Units (FSEU) generate discrete and position information 
for use by other avionic components of the aircraft. The flap position signal is a dc 
voltage. 

Flap position and flaps-up discrete information is used in Test ACT computations to 
schedule gains of the control laws for optimum stability. In the Test ACT Configuration, 
flaps-up discrete information from each of the three FSEUs goes into the Essential 
control laws of all four ACCs. A ground is provided on the console to simulate a fourth 
source of flap discrete information. In the event of a failure of one of the flap discretes, 
the system goes to the lower gain, flaps-up configuration. 

Flap position sensor connections are shown in Figures 21 and 23. 

6.2.2A Air-Ground System 

The 757-200 air-ground system uses proximity switches that are activated by nose gear 
oleo compression, right landing gear truck tilt, and left landing gear truck tilt. 
Connection of the air-ground system to the Test ACT computer is indicated in Figures 21 
and 24. 

Air-ground logic is used to lock out WLA, Primary PAS, and automatic stabilizer trim on 
the ground and preflight test in flight. It also initializes the signal selection and fault 
detection (SSFD) logic. 

Both on-ground signals are hardwired to each of the four Essential computers, and each 
Primary channel gets information from these relays via cross-channel buses. 

6.2.2.5 Stabilizer Position Sensors 

Stabilizer position is a fundamental parameter in the speed and elevator offload control 
laws. All computers receive this information by direct connection to a position sensor 
and/or by cross-channel buses, as indicated in Figure 22. 
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Stabilizer position signals are derived from the Stabilizer Position Module (SPM). Three 
identical SPMs are installed in the electric system card file, which is in the electronic 
equipment bay. They use an ac signal from a rotary variable differential transformer 
(RVDT) located in the position transmitter module to produce a dc voltage proportional to 
stabilizer position. Each SPM has both a stabilizer position and a monitor channel. The 
position channel output drives four output buffer amplifiers whose output is grounded if a 
fault is detected. 

6.2.2.6 Elevator Surface Position Sensors 

The elevator surface position sensors are dual synchros, one mounted on each elevator and 
hardwired to each Primary computer. The surface position signal will be derived from 
two windings of the synchro, and a third will be used for monitoring. Figures 21 and 22 
show the surface position sensor connections. 

Elevator position information is not presently used in the Test ACT control laws. It is a 
provisional signal that may be employed in flight test if unacceptable limit cycling 
develops. 


6.3 CONTROL AND WARNING PANELS 


6.3.1 TEST ACT PANELS 

Two of the Test ACT flight deck panels, the Test ACT Control Panel (TACP) and the 
Preflight Test Panel (PFTP), are located in the pilots' overhead panel. The Flight Test 
Programmer (FTP) is used only during flight test and is located in the control stand. 

6.3.1. 1 Test ACT Control Panel 

Physical Characteristics— The TACP (fig. 13, left) consists of seven switches and 
annunciators, hardwired to their associated connectors and circuitry, with discrete 
components mounted on a circuit board secured to the chassis. 

Operation— Figure 26 shows the TACP layout with two functional groups: Essential 

PAS/FBW and Primary PAS/WLA advisories. 
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Figure 26. Test ACT Control Panel-Front Panel Layout 


Essential PAS/FBW— The TACP contains a split-legend switchlight associated with each of 
the four Essential channels. While the switchlight is in the "on" position detent, a 
dedicated discrete output is provided to the respective ACC, indicating that engagement 
of that Essential channel is enabled. This switch is expected to remain in the "on" 
position, except when a failure has occurred; then it may be desirable to manually disable 
a channel or to make an attempt to reengage after an automatic disconnect. During 
normal operation the switchlights are not illuminated. 

When an ACC computer detects an Essential channel fault, it provides an automatic 
disconnect of that channel. The ACC also outputs a fail discrete to the TACP, which is 
used to illuminate that channel's "fail" message, located in the lower half of the 
associated switchlight. This annunciation is advisory and does not require flight crew 
action. 
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Placing the Essential PAS switch in the "off" position removes the dedicated enable 
discrete output to the associated ACC, thus removing power from the arm and engage 
relays and disabling servo reengagement. When the switch is in the "off" position, it also 
locally extinguishes the associated "fail" annunciation and illuminates the "off" 
annunciation. 

Cycling the switch back to the "on" position reapplies the enable discrete to the ACC and 
initiates Essential channel servo reengagement. This action also locally extinguishes the 
"off" annunciation and returns control of the "fail" annunciation to the ACC's dedicated 
fail discrete. 

All Essential PAS/FBW "off" annunciations are white, while the "fail" annunciations are 
amber. The four switch functions of the system are guarded to preclude inadvertent 
manual disengagement of any Essential servo. 

Primary PAS/WLA: Manual Primary PAS Disconnect Switch— This switchlight is provided 
to allow a manual disconnect of all four of the Primary PAS inputs to the Essential 
channels. 

The PAS "fail" annunciation is driven directly by discrete outputs from any of the four 
ACC computers. This advisory may be used as a cue to the flight crew to override the 
Primary PAS system by pressing the switchlight. (As flight safety is provided by hardware 
limiters in each ACC, flight crew action is not a safety requirement.) 

When the PAS switch is pressed, a dedicated PAS "on" discrete is removed from each 
ACC. Pressing the PAS switch also extinguishes the "fail" annunciation and illuminates 
the "off" annunciation. It is expected that this switch will normally be left in the "on" 
(detented) position. Because the PAS switch is guarded, inadvertent operation is unlikely. 

Primary PAS/WLA: Primary WLA Status — The TACP provides independent status annunci- 
ation and manual disconnect provisions for each WLA servo system. Two ACC computers 
are associated with each servo system. In normal operation, a dedicated "on" discrete is 
output from the TACP to supply power to the WLA engage relay of each of the ACCs. 
Upon detection of a failure, the ACCs provide an automatic disconnect and output a fail 
discrete to the TACP. These fail discretes are inputs to a hardware "OR" gate such that 
either ACC may directly illuminate its associated "fail" advisory annunciation. 
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Manual disconnect of a failed WLA system is provided by pressing the associated WLA 
switchlight. This action removes the dedicated "on" discrete from the ACC, locally 
extinguishes the "fail" annunciation, and illuminates the associated "off" annunciation. 

6.3. 1.2 Preflight Test Panel 

Physical Characteristics— The PFTP (fig. 13, right) consists of two switches and three 
annunciators, hardwired to their associated connectors and circuitry, with discrete 
components mounted on a circuit board secured to the chassis. 

Preflight Test Operation— Figure 27 shows the PFTP layout. This panel provides preflight 
test initiation and status advisories, as well as a monitored discrete output to drive an 
external "no dispatch" warning. 

To preclude the need for redundancy or monitored annunciations, preflight test steps 
occur in a specific order, with each step indicated by a pair of annunciation changes. 
Thus, the flight crew can verify correct test sequencing and detect annunciators that may 
be failed "on" or "off" due to system or PFTP failures. 



Figure 27. Preflight Test Panel-Front Panel Layout 
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The preflight test sequence is described in the following: 


At the termination of a flight leg or at aircraft power-up, the PFTP "no go" status 
annunciator is illuminated to indicate that a preflight test has not been completed since 
the last flight. 

The preflight test circuitry within the PFTP is enabled by the presence of two of four 
ACC discretes that indicate they are operating in the "on ground" mode. Preflight test 
availability is indicated by the first crew prompt message appearing on the Engine 
Indication and Crew Alerting System (EICAS) (sec. 6.3.2); testing is initiated by depression 
of the passive test switch, which operates a PFTP lamp test. The "no dispatch" output is 
monitored to verify its operation; assuming its warning is functional, the PFTP monitors 
discrete inputs from the ACCs. When three of four ACCs indicate their test is in process, 
the PFTP maintains the electrical position of the passive test switch via an internal 
solenoid and illuminates the passive test "run" annunciation. This same three-of-four 
logic is also used to remove the independent channel's "stim enable" lockout, thus enabling 
preflight test stimulation by the individual ACCs. 

The PFTP continues to monitor the ACC test discretes. Upon indication that at least 
three ACCs have successfully completed their passive tests and that no ACC has detected 
a passive fault, the passive test "run" annunciation is extinguished and the active test 
"arm" annunciation illuminated. This signal and the second crew prompt message on 
EICAS serve as flight crew cues to initiate the active preflight test when external 
conditions allow control surface movement. The flight crew initiates the active test by 
depressing the "active" pushbutton. This results in the removal of the active test "arm" 
annunciation and illumination of the active test "run" annunciation. The sequence of 
active test elements and crew prompts is controlled by the ACCs. 

Upon determination that three or four ACCs have successfully completed the preflight 
test, as indicated by the ACC test status discretes, the PFTP (1) releases the passive 
preflight test switch, (2) locks out the stim enable discretes, (3) illuminates the "go" 
dispatch annunciator, and (4) extinguishes the "no dispatch" warning output and "no go" 
dispatch status annunciation. 
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The dispatch status annunciation is interlocked to the solenoid-held "run" switch such that 
a "go" annunciation is only possible in the released position and a "no go," with remote "no 
dispatch," is always provided in the held position. 

The failure of any two ACCs to complete their preflight test successfully will terminate 
that test and result in a continuous "no go" status annunciation; the "no dispatch" warning 
will remain illuminated. 

No manual reset is provided for a "no go" indication. Clearing the "no go" or "no dispatch" 
annunciation requires reinitiation and successful completion of the entire preflight test. 
If takeoff is initiated without test completion, testing is aborted at ground speed greater 
than 26 m/sec (50 kn). An automatic reset of the "go" annunciation will be provided at 
liftoff (less than two of four ACCs indicate "on ground" mode). 

As shown in Figure 27, the passive and active preflight test request switches are guarded 
to preclude inadvertent activation. 

"No Dispatch" Warning Output— The PFTP provides combining logic and a current sink 
drive to control a remotely located red array (or equivalent) "no dispatch" warning. This 
warning will be annunciated during preflight test and will be extinguished upon its 
successful completion by three or more ACCs. Failure of two or more ACCs to complete 
preflight test successfully will result in a continuous "no dispatch" warning. No manual 
reset is provided for this annunciation. Resetting requires reinitiation and successful 
passing of preflight test. If takeoff is initiated without successful completion, the 
warning is extinguished at liftoff. 

6.3. 1.3 Flight Test Programmer 

Physical Characteristics— The FTP (fig. 13, center) consists of a single pushbutton switch, 
a 16-position rotary switch, and a toggle switch, all hardwired to the FTP rear connector. 

Operation— The FTP provides two functions within the Test ACT System: a capability to 
select and initiate preprogrammed flight test conditions and a Test ACT System arm and 
disconnect function. The FTP layout is shown in Figure 28. 
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Figure 28. Flight Test Programmer-Front Panel Layout 

Test Selection -Preprogrammed test conditions are chosen by placing the 16-position 
selected configuration switch in the position corresponding to the desired test. The 
position of this switch is continuously provided to the four ACCs by a binary code 
representation from four discretes. When the selected configuration switch is moved to a 
position other than position 1 (baseline), the "arm" annunciation in the status switch will 
illuminate, indicating a test configuration may be initiated. 

Test Initiation — Initiation of the selected test is accomplished by depressing the status 
pushbutton switch. A common initiate test request is provided to all ACCs via redundant 
discrete interfaces. Initiation of a test extinguishes the "arm" status annunciation and 
illuminates an amber "on" annunciation that will remain until the test is terminated. 

Test Termination — Test termination is provided by a second depression of the status switch 
or by rotation of the selected configuration switch to a different position. At 
termination, the "on" annunciation is extinguished, and the "arm" annunciation is 
illuminated if the selected configuration switch is in any position other than 1 (baseline). 

Test ACT System Arm and Disconnect of FBW Functions -Emergency disconnect of the 
Test ACT System is provided by placing the ACT status switch in the "off" position. This 
simultaneously causes a servo disconnect of all PAS servos by removing the excitation to 
the individual servo arm and engage relays located within the ACCs. Dedicated discretes 
are also provided to transfer trim control to the AFDS when the Test ACT System is 
disconnected and to inhibit the autopilot when it is engaged. 
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The Test ACT System PAS servos are armed by setting the ACT status switch to the 
"arm" position. This enables an independent automatic engagement of all servos if the 
other manual inflight engage requirements are completely met. Arming the Test ACT 
System also sends a single discrete output to inhibit the AFDS. 

The ACT status toggle switch is guarded to preclude inadvertent placement of the switch 
in the "arm" position. 

6.3. 1.4 Dedicated Warning Indicators 

The Test ACT System will have two warning (red) indicators placed above the glare shield. 
These two warnings will be "total loss of Essential PAS/FBW" and "total loss of Primary 
PAS." 

6.3.2 AIRPLANE SYSTEM 

This section describes the Engine Indication and Crew Alerting System (EICAS) that will 
be used by Test ACT for annunciations to the pilots. 

EICAS is an indication and alerting system that receives, processes, and displays all 
engine information required by the flight crew; it also receives and processes information 
from airplane subsystems and then displays necessary crew alerting messages (warnings, 
cautions, and advisories). For Test ACT, EICAS will be used to annunciate crew-prompt 
messages to the pilots during preflight test. The test phases are begun manually; for 
active preflight test, the crew must provide certain initial conditions, specific flap 
settings, and a column pullthrough. These crew actions are prompted with the first set of 
messages in Table 1. EICAS will also be used to annunciate system failures in the form of 
caution and advisory messages; they are listed in Table 1. 

6.4 TEST ACT CONSOLE 

The Test ACT Console (TAC) (fig. 14) consists of a pair of multibay racks designed to 
house the Test ACT computers and associated equipment for software loading and system 
evaluation. It will be used first for system test in the laboratory and later will be 
mounted in the test airplane for flight test operations. 
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Table 1. EICAS Messages for Test ACT 


CREW PROMPTS 

1. Press passive 

2. Clear surfaces, hydraulics on, flaps zero, press active 

3. Extend flaps 

4. Pull column 

5. Push column 

6. Test complete 

CAUTIONS 

1. One failure from loss of Essential PAS/FBW 

2. Total loss of WLA 

3. No dispatch 

ADVISORIES 

1. Maintenance required 

2. Full-time no dispatch 


6.4.1 CONSOLE CONCEPT 

The standard Boeing flight test rack affords convenient means of housing the equipment 
and enabling the shift from lab to airplane with minimal disassembly. Two such racks 
together form the Test ACT Console. The individual racks plus their contents are labeled 
console No. 1 and console No. 2. 

All hardware in these consoles is designed to be rugged in order to retain a safe cabin 
environment in flight test. 
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6.4.2 SYSTEM HARDWARE CONTENT 


For laboratory use, the console will house all the Collins-supplied Test ACT System 
hardware listed below: 


LRU 


Type No. 


Quantity 


Active Controls Computer 

ACC-701 

Test ACT Control Panel 

TACP-701 

Preflight Test Panel 

PFTP-701 

Flight Test Programmer 

FTP-701 

Pitch-rate gyro 

345-A9 

Column force transducer 

CFT-100 

Wing accelerometer 

ACL-111 


4 

1 

1 

1 

4 

2 

8 


These units are powered and interconnected within the console. Interconnect points are 
provided to tie the console to the laboratory where remaining system components (such as 
servos, trim systems, IRSs, DADCs, etc.) are provided in either real or simulated form. 
Tie points for the console interconnect are contained in a junction box to which all sensor, 
control, and aircraft interfaces are connected. It provides military-type twist-lock 
connectors for the interfaces to allow mobility of the console and its components. Circuit 
breakers for the 28-V dc ACC input power are mounted in the box, providing protection 
either in the laboratory or in the aircraft. Wiring is physically arranged to meet safety 
segregation requirements of the Test ACT System. The junction box is mounted in 
console No. 2 behind the breakout panels. 

When the console is moved to the airplane, sensors and control panels will be removed and 
installed in their appropriate locations; the ACCs will remain in the console. Other 
aircraft systems and sensors will be connected to the console via the same interface 
points used in the laboratory. 

6.4.3 TEST SUPPORT HARDWARE 


The Test ACT Console also contains equipment that is not required for the system to 
perform its functions but rather supports the testing of the system. 
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6.4.3. 1 ACC Breakout Panels 


A breakout panel for each of the four ACC units provides "break-in" and "break-out" test 
points between the ACC and other line replaceable units (LRU) in the Test ACT Console 
and lab interface. The front of the panel provides test points for every contact of each 
ACC connector. Plugs are installed to enable breaking of the signal path for fault 
simulation or alternate signal injection. During flight these plugs are positively retained 
by a clear plastic cover panel (entire breakout panel may be bypassed for safety in flight). 
The ACC breakout also has test points that are brought from inside the computer to the 
panel unit via the test access card. 

6.4.3.2 Power Control Panel 

In the laboratory environment, all power to the Test ACT Console is distributed by the 
power control panel. This panel provides breaker protection for 115-V ac, 60-Hz 
equipment and breaker protection and switching for the 28-V dc power to the ACCs, FTP, 
PFTP, and TACP. The latter is arranged to duplicate the aircraft installations, enabling 
valid testing of various power configurations. All power is routed through a normally open 
power relay that is electrically held closed to operate the console. An emergency 
disconnect button is provided to open the power relay and quickly remove power from 
console equipment. 

During flight test, power to ACC breakers in the junction box will come directly from the 
aircraft through cockpit breakers, bypassing the power control panel. The power relay 
will no longer affect the computers, thus eliminating the possibility of a single-point total 
loss of power. Power will still be provided for the Hewlett-Packard terminal and the 
master processor. Because these will only be used for data gathering in flight, loss of 
their power would not affect Test ACT System performance. 

6.4. 3.3 CAPS Test Adapters 

The Collins Adaptive Processing System (CAPS) Test Adapters are provided as a software 
development tool for CAPS processors. Each adapter interfaces with a CAPS processor 
and transfer bus inside an ACC via a test access slot and a transfer bus cable. The Test 
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Adapter may become a "master" on the bus and, as such, may command read and write 

operations by any "slave." It may also monitor all processor transactions on the bus. 

Because the adapter has control of the bus and can halt it as a result of operator 

instructions, the adapter will be disconnected during flight test to preclude inadvertent 

external interference with bus operations. 

The CAPS Test Adapter provides the following functions: 

• Halt— Stops all bus activity. 

• Reset— Resets the CAPS processor. 

• Run— Allows bus activity to continue. 

• Bus step— While halted, executes single instructions. 

O Exam— Reads contents of particular bus locations. 

o Deposit— Loads data into particular bus locations. 

© Monitor— Monitors reads and/or writes of particular locations. 

o Breakpoint— Halts bus activity at the occurrence of a read and/or write of a 

preselected particular location; also, sets the halt to occur only if the information 
does or does not match a preselected value. 

o History-Examines and continuously saves the last 16 bus transactions (address, data, 
and read or write) during a halt. 

© Analog output-Four buffered digital-to-analog (D/A) converters provide analog out- 
puts proportional to a digital value that is read from or written to four selected 
addresses. 

The CAPS adapter also interfaces with the master processor via the master processor bus. 
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6.4. 3.4 Master Processor 


The master processor, with its operating system software, performs three major tasks: (1) 
interaction with the Hewlet-Packard terminal via an RS-232 bus, (2) interaction with the 
CAPS Test Adapters, and (3) collection of inflight fault information via ARINC 429 buses. 
The processor monitor program responds with printed messages to commands keyed into 
the terminal. Under control of the terminal, the monitor program handles various 
operations such as tape-to-memory load operations, memory verification operations, and 
many of the other functions provided by the CAPS Test Adapter panel (sec. 6. 4. 3. 3). 


As mentioned previously, the master processor functions as a data collection point for 
flight test fault information. The processor will receive data from each of the four 
computers via four ARINC 429 receivers. In a portion of the normal application program, 
the ACCs transmit preselected failure data to the master processor. These data are 
formatted and stored by the monitor program and are available for display. 

6.4. 3. 5 Terminal 

The Hewlett-Packard HP-2645A terminal provides I/O capability for the digital test 
equipment in the TAC. It consists of a keyboard, a cathode ray tube (CRT) display, and a 
dual minicassette magnetic tape drive. The keyboard is used to input manual commands 
to the master processor via RS-232 Standard. During laboratory test, software input 
comes from cassette cartridges; the CRT displays output data. 

6.4.3.6 Line Replaceable Unit Mounting Racks and Forced Air Cooling System 

The TAC has aircraft-type mounting shelves with rear connectors and hold-down 
mechanisms. Each shelf provides positive pressure cooling air to the bottom of the 
computers. The sources of this ambient temperature air are 400-Hz fans, one mounted on 
each shelf. The four computer shelves are mounted on a carriage that may be extended 
from the console, allowing access to the sides of the units for test purposes. 

The TAC contains a Test ACT annunciation panel that indicates loss of computer cooling 
air. These indicators, whose information comes from air flow sensors, are easily visible to 
the test engineer in his normal test flight position. The panel is also the laboratory 
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mounting fixture for the FTP, PFTP, and TACP. No forced air is provided to these units 
since the design allows sufficient free air flow for self-cooling. 

To facilitate laboratory simulation, the flight sensors (accelerometers, rate gyros, and 
column force transducers) are mounted above the breakout panels. A mechanism is 
provided to allow the console operator to apply force to the column force transducers. 

6.4.3 .7 Flight Test Instrumentation Interfacing 

By means of a circuit card in each ACC, the Test ACT Console supplies four high-speed 
ARINC outputs for instrumentation use. With appropriate programming of these cards, 
internal software variables are transmitted, and a buffered output of each ARINC cross- 
channel bus is provided. 

6.4.3.S Collection Panel 

The collection panel provides stop, step, and start coordination among the CAPS Test 
Adapters. If the master adapter panel is armed in the "first stops all" mode, any CAPS 
adapter halting one CAPS processor will cause all four ACC CAPS processors to halt 
simultaneously. Once halted, all four processors may be stepped by pressing the "all step" 
switch on the collection panel. Conversely, they may be started simultaneously by 
pressing the "all start" switch. An "all stop" switch causes the halt of all four ACC CAPS 
processors. 


74 



7.0 SYSTEM DESIGN: 
PRIMARY SOFTWARE 



7.0 SYSTEM DESIGN: 
PRIMARY SOFTWARE 


Page 


7.0 SYSTEM DESIGN: PRIMARY SOFTWARE 75 

7.1 Software Organization 75 

7.1.1 Executive 76 

7.1.2 Control Law Computation 77 

7.1.3 Redundancy Management 77 

7.1.4 Failure Detection 79 

7.1.5 Flight Deck Interface 81 

7.1.6 Test ACT Console Outputs 81 

7.1.7 Test Option Control 82 

7.2 Software Methodology 82 

7.3 Software Adaptable From 757/767 Autopilot/Flight Director System 82 



7.0 SYSTEM DESIGN: PRIMARY SOFTWARE 


Primary software implements all Test ACT Primary control law functions, plus the testing 
and management of the Test ACT System components. The functions are executed both 
in preflight test and during flight and include test options that are selectable in flight. 

7.1 SOFTWARE ORGANIZATION 

The Primary software is composed of seven functions: executive, control law 

computation, redundancy management, failure detection, flight deck interface, Test ACT 
Console (TAC) outputs, and test option control (fig. 29). Each of these is described in 
subsequent paragraphs. Approximately 16 000 words of software are distributed among 
the functions, according to the percentages shown in Figure 30. 



Figure 29. Primary Software Functions 
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Figure 30. Test ACT Software Summary 

7.1.1 EXECUTIVE 

The executive function consists of the top-ievei Active Controls Computer (ACC) 
software and is broken down into the following: 

0 System states and task scheduling 
0 Hardware interrupt servicing 
o Initialization 

The executive establishes the multirate structure for foreground software functions and 
controls the execution of background computations. Executive processes fall into two 
categories: interrupt-mode processes, which include all operating system tasks required to 
service central processing unit (CPU) interrupts, and user-mode processes, including all 
tasks necessary to perform real-time and background scheduling and execution of 
operational tasks. 



7.1.2 CONTROL LAW COMPUTATION 


The control laws are divided into three major parts to implement the Primary control 
requirements: 

• Aileron commands for wing-load alleviation (WLA), including both maneuver-load 
control (MLC) and gust-load alleviation (GLA) 

• Elevator commands for fly-by-wire control augmentation and stability augmentation 

• Stabilizer trim commands to avoid saturation of the limited-authority elevator 
command 

Two subfunctions are used by each of the previously mentioned control law computations: 

• Gain schedules and limiters that modify the control laws as a function of flight 
conditions 

• Control law logic, providing mode switching and transient suppression during mode 
transitions 

7.1.3 REDUNDANCY MANAGEMENT 

The redundancy management function determines the utilization of redundant system 
resources. It incorporates two principal subfunctions: sensor management and output 
management. Sensor management (signal selection and fault detection, described in 
following paragraphs) combines redundant sensor inputs to produce high-integrity values 
for sensed parameters. The output management function manages associated output 
redundancy, determining ACC WLA and trim engage status and Primary pitch-augmented 
stability (PAS) validity. 

The signal selection and fault detection (SSFD) function is designed to operate on a set of 
four continuous, redundant sensor signals. Only three of the four are required for normal 
operation of the SSFD. The fourth sensor signal is labeled as a "spare" if it is valid, 
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otherwise the term "no spare" is used. However, there are sensor sets in the proposed 757 
flight test airplane that have a maximum of two or three sensors. The SSFD 
algorithm operates on any of the variables listed in Table 2, provided at least two sensor 
signals are available. There are four major functional objectives of the SSFD algorithm: 
(1) to extract the most useful data from each redundant set of sensor signals, (2) to 
determine and isolate any sensor signal that is outside a preset tolerance limit, (3) to 
replace an isolated sensor signal with the "spare" or with the previously selected signal 
output of the SSFD if no spare exists, and (4) to upmode or reinstate an isolated signal to 
either the "active" or "spare" signal state when it reenters the preset tolerance limits for 
a sufficient period. 

The previously mentioned objectives have been achieved through the use of four major 
subfunctions: (1) the signal selection function, (2) the fault detection function, (3) the 

sensor selection function, and (4) the SSFD initialization function. 

The signal selection function utilizes the integral equalization technique on the redundant 
continuous-valued sensor signals to select the best signal. The selected signal is the mid- 
value of the equalized signals among the candidate inputs. 

The fault detection function assesses the validity of the preceding sensor signals using 
sensor signal comparison and direct/inline monitoring of the sensor sets. Sensor signal 
monitoring is based on the instantaneous and long-term deviations of the sensor signals 
from the selected signal. Direct monitoring is based on such single-sensor inputs as direct 
activity, sign status matrix, common-mode monitors, and range. 

The sensor selection function selects the candidate inputs to the signal selection function, 
which may be sensor or artificial signals. If fewer than two sensor signals are selected as 
candidate signals, the sensor selection function renders the corresponding sensor set 
invalid. 

The SSFD initialization function establishes initial conditions of time-dependent 
computations for the SSFD subfunctions. 
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Table 2. Continuous-Valued Sensor Signals 


Sensor 

Signal 

Source 

Elevator position (DE) 

Elevator surface 

Flap position (DF) 

FSEU 

Column force (FCOL) 

Pilot's column 

Stabilizer position (DS) 

SPM 

Normal wing acceleration (NZW) 

Accelerometer 

Body pitch rate (QB) 

IRS 

Pitch attitude (THETA) 

IRS 

Roll attitude (PHI) 

IRS 

Body normal acceleration (NZB) 

IRS 

Ground speed (VGND) 

IRS 

Flight path acceleration (VTDOT) 

IRS 

True airspeed (VTRU) 

DADC 

Impact pressure (QC) 

DADC 

Computed airspeed (CAS) 

DADC 

Mach number (MACH) 

DADC 
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7.1.4 FAILURE DETECTION 


Failure detection software assesses the ability of the Test ACT System to perform its 
design functions. Major subfunctions of failure detection are: 

• Power-up tests 

o Fault consolidation 

• Periodic tests and monitors 

• Preflight tests 

Together these tests and monitors assess Primary computer performance and detect 
failures in the sensors, hardware monitors, Essential computers, actuators, and interfaces. 

Power-up testing checks the operational capability of the ACC. Included are hardware 
interface checks, data and program memory tests, performance monitor tests, and error 
interrupt hardware checks. Power-up test execution occurs whenever power is applied to 
the ACCs. 

The periodic tests and monitors routine is divided into the following four subfunctions: 

O Software-interrogated hardware monitors 
O Software-controlled hardware monitors 
O Software monitors 

q Software tests 

Software-interrogated hardware monitors consist of those routines that periodically read 
the hardware monitor's state and set a flag if a monitor trips. This subfunction monitors 
Essential system sensors and Primary system buses. Software-controlled hardware 
monitors require periodic software stimulus and consist of Primary computer performance 
monitoring. Software monitors evaluate the health of normally operating system 
functions, whereas the software tests present data patterns that do not normally occur in 
flight to test data buffers and the CPU. 

Preflight tests are subdivided into passive and active series; each series is initiated by 
engaging a switch on the Preflight Test Panel. Passive tests verify Primary and Essential 
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system components that do not produce control surface movements. Active tests require 
hydraulic system pressure before testing control functions that may result in aileron, 
elevator, or stabilizer deflections. 

Fault consolidation is a subfunction in terms of requirements only; i.e., the software 
implementation of requirements is distributed among various sections. Fault 
consolidation assesses the status of numerous monitors to determine: 

• Primary PAS validity 

• Executive monitor failures 

• WLA validity 

• Computer channel validity 

• System dispatch status 

• Assessment of maintenance requirements 

• Local Essential interface validity 

7.1.5 FLIGHT DECK INTERFACE 

The flight deck interface functions manage the physical interfaces with flight deck 
annunciations, the Test ACT Control Panel (TACP), the Preflight Test Panel (PFTP), and 
the Flight Test Programmer (FTP). Flight deck interface functions consolidate inputs 
from the FTP, as well as inputs and outputs for the PFTP. They use inputs from the fault 
consolidation functions and other ACC software to drive maintenance and dispatch status 
annunciations. 

7.1.6 TEST ACT CONSOLE OUTPUTS 

Test ACT Console output functions provide processing to format and transfer fault and 
pertinent status data to the TAC for display, both on ground and during flight. Status 
data include the following information from each ACC: computer identification, trim and 
WLA control status, FTP state, and Primary computer state. 
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7.1.7 TEST OPTION CONTROL 

Test option control provides the software interface between the ACC and the FTP. It 
responds to discretes provided by the FTP in selecting, initiating, and terminating 
implementation of any one of 16 preprogrammed test conditions within the ACC control 
law functions. 


7.2 SOFTWARE METHODOLOGY 

All Primary software was developed under Univac's EXEC-8 operating system on a Univac 
U1100 system, located at Rockwell's Scientific Computing Center in Seal Beach, 
California. 

The Test ACT processor is a CAPS-6B model of the Collins Adaptive Processing System 
(CAPS) family that is designed to support embedded, real-time applications programmed 
in a high-level language (HLL). The Test ACT software was written in ALGOL Extended 
for Design (AED), a descendant of ALGOL-60. 

7.3 SOFTWARE ADAPTABLE FROM 757/767 
AUTOPILOT/FLIGHT DIRECTOR SYSTEM 

Although most of the software for the Test ACT Program is new, two routines were 
transferred from the 757/767 autopilot virtually intact. These are the power-up tests and 
the CPU self-tests. The power-up tests check a number of hardware monitors, including 
the random-access memory (RAM) parity monitor, computer cycle monitor, and CPU self- 
test monitor. The CPU self-test verifies the functional capability of the CPU itself. 
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8.0 SYSTEM DESIGN: MECHANICAL 


8.1 MECHANICAL CONTROLS: TEST INSTALLATION 


8.1.1 GENERAL 

This section describes the design of the 757 mechanical pitch control system, as modified 
for flight testing of the Test ACT System. The modifications affect two parts of the 
airplane: the flight deck area below the pilots' floor and the empennage area near the 

horizontal stabilizer rear spar (fig. 31). Test ACT mechanical elements include two 
independent pilot pitch command paths: one for electrical flight and one for mechanical 
flight, plus quadruplex electrohydraulic servos whose outputs are linked differentially with 
the existing cable system to modulate the elevator surface actuator valves. 

The design shown is intended to meet all requirements of Section 4.2.1. The selection of 
the arrangement and components has been directed toward maximum performance and 
safety of the Test ACT System. Particular emphasis has been placed on reduction of 
friction and freeplay in the mechanical signal paths to simulate the very low pitch control 
hysteresis that will be a primary requirement of reduced-stability airplanes. A major 
objective of the Test ACT flight program will be to evaluate the effect of varying levels 
of hysteresis on system performance, leading to standards for future mechanical control 
component design. 

Hysteresis characteristics of the basic 757 pitch system have been determined, and design 
actions for improvement of the Test ACT System have been derived from a test program 
conducted on the 757 "Iron Bird." A test summary is presented in Appendix B. 

To facilitate a simple and economical test installation in the 757 airplane, certain 
mechanical design ground rules were adopted: 

• The normal 757 "neutral shift" function, in which the elevator is geared to the 
stabilizer for greater nose-down trim effectiveness, will be deactivated for the Test 
ACT Configuration. This removes the complication of trim point shift on the 
mechanical system side of the summing junction. 
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• The normal 757 flaps-up stabilizer nose-down electrical limit will be increased from 
+0.8-deg stabilizer angle to +3.8-deg stabilizer angle. This will ensure adequate nose- 
down trim authority when combined with an increased elevator downrig throughout 
the anticipated Test ACT flight regime. 

• The Test ACT pilot station will be located at the first officer's (right-hand) seat 
position. The right-hand position offers better clearance and access for the under- 
floor Test ACT mechanism installation. Also, the existing 757 mechanical system 
rigging datum at the left-hand column is preserved, allowing for simpler conversion 
between Test ACT and conventional flight configurations. 

Mechanical jam protection for elevator control is provided as follows for Test ACT: 

• Electrical and mechanical control modes are each available to the other as backup 
for mechanical jams upstream of the summing junction. 

• Overrides that allow separate control of right and left elevators are not provided for 
Test ACT. 

• A jam of an elevator surface actuator valve will be overrideable by either electric or 
mechanical mode during Test ACT flight. 

These provisions, plus appropriate preflight inspection and full-scale exercise of the Test 
ACT installations, will ensure a jam-free flight program while avoiding the complexity 
and performance compromises of a total jam isolation design policy. 

8.1.2 SYSTEM ARRANGEMENT 

Figure 32 shows the elevator system schematic for the unmodified 757 airplane. The 
system features conventional dual mechanical cable controls with a pilot/copilot breakout 
forward and a limited right/left breakout aft. A dual variable feel unit controlled by dual 
feel computers (not shown) attaches to the aft cable quadrants, as do triple autopilot 
servos. Linkage from the aft quadrants to right and left triple-parallel actuator 
installations provides valve input motion to position the single elevator surfaces on each 
side. Centering springs, valve pogo links, and shearouts protect against disconnects, valve 
jams, and freezeups at the surface actuators. Neutral shift linkage causes the feel unit to 
be reindexed to increase stabilizer effectiveness in the nose-down trim range. 
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The elevator mechanical control schematic for Test ACT is shown in Figure 33. This 

arrangement reflects the following changes and additions to the basic 757 system: 

• The first officer's column is disconnected from the mechanical system by disengaging 
the forward breakout and removing the right-hand body cable system input rod. 

• A Test ACT pilot input mechanism is installed and connected to the first officer's 
column. The mechanism consists of dual four-channel force transducers, a feel cam 
and springs, and a rate damper. 

• The forward right and left cable tension regulators are bused together to retain the 
stiffness of both cable paths for the mechanical control mode. 

• A solid bus replaces the limited breakout between the aft cable quadrants. This 
provides a more rigid reaction path to ground during fly-by-wire (FBW) control. 

• One pitch autopilot servo is retained in its 757 installation position, attached to the 
aft cable quadrant. In addition to mechanical-mode autopilot functions, this unit 
provides, through special modifications, an added increment of detent to react 
summing lever loads during FBW flight. 

• The production pitch control feel and centering is retained unmodified, providing 
normal pilot feel functions in mechanical flight mode and, in parallel with the 
autopilot servo, a detent to react FBW loads. 

• The neutral shift function is deleted. This involves removal of linkage between the 
stabilizer and the grounding point for the feel unit. The grounding point is then fixed 
at the desired rig position with a bolt to structure. 

• The four Test ACT secondary servos, the servo summing shaft, and the servo voting 
detent mechanism are installed aft of the aft cable quadrant, using the support and 
space provisions of the upper two pitch autopilot servos. The new servos are 757 
rollout guidance actuators, modified for increased rate and output path stiffness. 

• Right and left Test ACT summing lever linkages are installed. These provide the 
summing function for the Test ACT servo and mechanical system inputs. It should be 
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noted that normally only one input mode will be in control; however, the signals from 
one mode may be offset or augmented by inputs from the other, if necessary. Each 
mode has input authority of 100% of elevator. Limit stops in the mechanism prevent 
the summed transmitted signal from exceeding available surface actuator input 
travel. 

The surface actuators and actuator input linkages are unchanged, except for the 
addition of a light, antihysteresis spring behind the control valve spool in each 
actuator. 


Hydraulic systems are assigned to the various Test ACT actuators, as shown in 
Figure 34. Surface actuator hydraulic assignments, which provide for all three 
systems to each elevator, are unchanged from the basic 757. 



ACC ACC ACC ACC 

No. 3 No. 1 No. 4 No. 2 


Figure 34. Test ACT System Hydraulic Schematic 







8.1.3 SYSTEM DESIGN 


Figure 35 shows the current 757 control column and forward tension regulator 
arrangement. The Test ACT flight deck installation is shown in Figure 36. A more 
detailed description of this installation is provided in Appendix D. 


Figure 37 shows the current 757 empennage pitch control installation in isometric view. 
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Figure 36. Test ACT Flight Deck Mechanical Installation 



Aft Quadrant 



The major changes effected by the Test ACT empennage installation are shown in 
Figure 38, in isometric form. A more detailed description of that installation may be 
found in Appendix D. 

Requirements relating to the Test ACT secondary actuators, autopilot actuator, and 
primary actuators may be found in Section 4.2.1. 



Figure 38. 757 Test ACT Elevator Control System-Empennage Installation 
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Actuators selected for use on the Test ACT airplane are units currently used on the 757, 
modified to comply with the requirements of Section 4.2.1. The selected actuators are: 

• Test ACT servo (secondary actuator)— 757 rollout guidance servo 

• Test ACT autopilot/detent servo— 757 pitch autopilot servo 

In addition, the existing 757 elevator surface actuators are modified to add valve bias 
springs. A more detailed description of these actuator modifications is contained in 
Appendix D. 


8.2 ELECTRIC EQUIPMENT INSTALLATIONS 

Figure 39 is a plan view of the Test ACT airplane showing the general location of the 

equipment added to enable the Test ACT flight test. The following sections treat the 

installation of individual items. 

8.2.1 SENSORS 

Installation of the three sets of sensors dedicated to the Test ACT System is as follows: 

o Column force transducers— These force transducers are a part of the Test ACT 
modification of the mechanical flight control system and are treated in Sections 8.1.2 
and 8.1.3. 

• Pitch-rate gyros— The set of four pitch-rate gyros is mounted on the main cabin floor 

near the nominal airplane eg. 

e Wing accelerometers— The installation of the wing accelerometers used in wing-load 
alleviation (WLA) instrumentation will be designed for the best compromise of high 
sensitivity to the first wing bending mode and suppression of the higher wing 
structural modes. Structural data derived in the 757 Airplane Project will be used to 
analyze wing bending and determine an optimum accelerometer location. The 
resulting position will probably be in the outboard wing at about 7096 semispan on the 
front spar or rib. The accelerometer axis of sensitivity will be aligned perpendicular 
to the wing reference plane. 
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Test ACT Control 



Figure 39. Components of Test ACT System-757 
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8.2.2 FLIGHT DECK PANELS 


Figure 40 illustrates the location of the three Test ACT panels required in the flight deck. 
They will be accessible to both pilots from their normal seated position. 

Two of the panels, the Test ACT Control Panel and the Preflight Test Panel (sec. 6.3.1), 
will be a part of the Production ACT System. They will be mounted in the pilots' 
overhead panel, as shown at the left in Figure 40. The Flight Test Programmer is 
applicable to Test ACT only and includes a "big red switch" that completely disables the 
system in case of emergency. This is located in the control stand just aft of the quadrant 
controls and opposite the pilots' elbows. 


Test ACT Preflight 
Control Test Forward 



Pilots' Overhead Panel 


o 

Forward 


Flight 

Test 

Programmer 



Figure 40. Control Panel Placement in the 757 Flight Deck 
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8.2.3 CONSOLE AND CABLES 


Figure 41 illustrates the two possible arrangements of the Test ACT Console in the aft 
part of the main cabin. The location of console No. 1, on the left side of the cabin a short 
distance aft of the left emergency egress door, has been established. At this stage in the 
test aircraft operations planning, it is not possible to determine positively the location of 
console No. 2; two locations are shown in the diagram. The preferred location near 
console No. 1 and across the aisle will result in the shortest cable run and the best 
accessibility. The alternative location, labeled "worst case," will be provided for in the 
cable design. 

The preferred position will have both consoles on the normal cabin floor level, making it 
necessary to provide the interconnecting cable with a sturdy protective cover. The 
cabling to the flight deck, the electronic equipment bay, the rate gyro box, and the wing 
accelerometers will all go forward from the consoles underneath the raised floor area, as 
is normal for cabling in the flight test airplane cabin. 
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Figure 4 1. Test ACT Console Placement-757 Main Cabin 
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9.0 SYSTEM VERIFICATION 


System verification is the process used to determine whether or not the Test ACT System 
meets the requirements of the Specification Control Drawing (SCD), Volumes 1 and II. 

9.1 VERIFICATION METHODS 

Components of the Test ACT System were shown to meet the requirements of the SCD by 
means of five verification procedures (fig. 42). Application of this process demonstrated 
compliance with all SCD requirements, excluding the waivers noted in Section 9.6.2. 
Figure 42 also shows the documentation provided at hardware delivery to demonstrate 
compliance. 


9.2 ANALYSES 

Analytical methods were used to verify the following system features: 

• Reliability, dispatchability, and safety 

• Channel equalization 

• Environmental impact 

• Flightworthiness 

Reliability analyses are treated in depth in Section 10.3. Environmental impact and 
flightworthiness were based largely upon similarity to the Autopilot/Flight Director 
System equipment for the 767 and 757 Programs. 

9.3 INSPECTION 

The Test ACT System hardware was inspected at appropriate steps in its manufacture by 
Quality Assurance representatives of both Collins and Boeing. The Boeing Quality 
Assurance department maintains a resident inspector at Collins in Cedar Rapids; he was 
available to inspect and approve the system equipment as it progressed through the 
system fabrication process. 
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Figure 42. System Verification Plan 
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9.4 SOFTWARE VERIFICATION 


The three software verification procedures included in Figure 42 were utilized to augment 
the Active Controls Computer (ACC) software verification, which was obtained in the 
System Acceptance Test (SAT). The following is a brief description of these procedures: 

• Design "walkthroughs" verify that the software design, as documented in the Design 
Implementation document (DID), complies with the SCD and includes no unintended 
functions. 

• The code inspections verify that the code faithfully implements the DID design. 

• Analysis of the SAT coverage verifies that it executes all program branches. 

The results of the software verification tasks were documented and submitted in the 
Software Verification document. 


9.5 UNIT ACCEPTANCE TESTS 

The Unit Acceptance Tests (UAT) were performed on selected line replaceable units 
(LRU) of the system and were designed to be capable of verifying that each LRU is fully 
functional. This testing was applied to the following units: 

• Active Controls Computer 

• Pitch-rate gyro 

• Preflight Test Panel 

• Wing linear accelerometer 

The System Acceptance Test provided verification of the other LRUs. 
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9.6 SYSTEM ACCEPTANCE TESTS 


The System Acceptance Tests verified the performance of the Test ACT equipment as a 
system and certain of the LRUs as units. These tests had the following characteristics: 

• They emphasized end-to-end testing. 

• Verification was based on easily observed system effects, such as servo disconnects 
and annunciations. 

• Measurements required were limited to those that could be made through the Test 
ACT Console (TAC) breakout panel (which provides access to all the pins of the ACC 
rear connector) and the Collins Adaptive Processing System (CAPS) Test Adapters 
(which provide access to the transfer buses). 

• Fault insertion was limited to power interrupts, disconnecting of equipment cables, 
simulated interface faults inserted at the breakout panel, and simulated processor 
faults inserted via the CAPS Test Adapters. 

9.6.1 TEST CONFIGURATION 

The System Acceptance Tests were performed with the test configuration shown in 
Figure 43. Ail of the airplane equipment and features necessary to provide inputs to and 
accept outputs from the Test ACT System are represented by the simulators that surround 
the ACCs in that figure. 

9.6.2 ACCEPTANCE TEST RESULTS 

The witnessed System Acceptance Test series was run at Rockwell-Collins in Cedar 
Rapids from 15 June through 24 June 1983. It included complete execution of the 
approved System Acceptance Test Procedure, plus some Unit Acceptance Tests on a 
complete ACC and phase and gain testing of an analog Essential computer. Those Unit 
Acceptance Tests were required to demonstrate that the system satisfies procurement 
specifications. 
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SAM/STCM 

Stabilizer Trim Simulator 



Figure 43. Configuration for System Acceptance Tests 
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Twenty-eight problem reports were recorded in the preceding procedure. Five of those 
were ascribed to minor specification shortcomings and hence were not charged to Collins. 
Several problems, most of them recorded in a single report, were traced to faulty jacks in 
the TAC breakout panels; their correction required rewiring of the panels, and that task 
carried over into the postdelivery period. The rest of the 28 problem reports were cleared 
before the second test period on 29 and 30 June 1983. In the same interim period, five 
additional problem reports were written; all of those were cleared except for one 
software change that will be handled by the Collins Service Center in Seattle. 

In the second period of witnessed testing, the effectiveness of corrections to the problem 
reports per the previous listing was verified. Official acceptance notification was then 
transmitted to Collins, and the system was delivered to Boeing. 
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10.0 PERFORMANCE ANALYSIS 


10.1 TEST ACT AND PRODUCTION ACT 

As configured for flight testing, the Test ACT System is not expected to meet production 
requirements for system and schedule reliability. This is because the test airplane has 
insufficient redundancy in certain equipment that cannot be augmented cost effectively. 
Test ACT includes a four-channel system of Primary and Essential computers and 
actuators, designed to function optimally with quadruple sensors and power supplies. The 
757-200 test airplane has only two Digital Air Data Computers (DADC), three Inertial 
Reference Systems (IRS), and three hydraulic supplies. In addition, the Test ACT servo 
installation operates through existing mechanical linkage and surface actuators. This 
arrangement provides less jam protection and introduces greater hysteresis than a 
prospective Production ACT System, which would incorporate closely coupled servo 
control units and preserve complete isolation of left and right surface input paths. 

In order to estimate the reliability of a Production ACT System designed for commercial 
operation, it was necessary to specify the assumed redundancy level of associated airplane 
systems. Because of the "brick-walled" architecture of four-channel Essential pitch- 
augmented stability (PAS), any equipment required by the Essential system, down to the 
summing bars, must necessarily be quadruplicated. This is not a requirement for the four- 
channel Primary system, which is not brick walled nor required for safety of flight. 

During Test ACT development, alternative configurations were examined as candidates 
for a Production ACT System. These were: 

• A system in which all Primary (as well as all Essential) components are 
quadruplicated. This approach increases system reliability, airplane schedule 
reliability, and safety but at the expense of higher initial and operating cost. As in 
the Test ACT System, the probability of erroneous control surface commands is 
minimized by disconnecting the Primary system if there is disagreement between the 
last two remaining operational channels. 

• A system with triplex IRSs and DADCs and therefore lower cost than the all- 
quadruplex system. System reliability and schedule reliability are maintained by 
allowing the Primary system to function with only a single sensor of each type. 
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Protection against unacceptable surface transients, when degrading to single sensor 

operation, is provided by three independent techniques: 

• Inline monitors are used to give a high degree of assurance that any single sensor 
selected will be the "correct" one. 

• Hardware authority limiters in the Essential system limit the transient that can 
be induced by the Primary computers. 

• Software authority limiters in the Primary computers limit the transient that 
can be caused by a malfunctioning sensor. Note that the signal selection 
algorithms in the Primary computers will eliminate all initial faults by 
comparison with the remaining "good" signals. 

As shown in Table 3, the system with triplex IRSs and DADCs has been assumed as the 
Production ACT System for reliability estimation purposes. Section 10.2 deals with the 
Test ACT System; Section 10.3 is based upon the Production ACT System. 


Table 3. Airplane Systems Redundancy for ACT 


Item 

Test 

ACT 3 

Production 

ACT 

Digital Air Data Computers 

2 

3 

Inertial Reference Systems 

3 

3 

Flap position sensors 

3 

4 

Stabilizer position sensors 

3 

3 b 

28-V dc power sources 

4 

4 b 

Hydraulic systems 

3 

4 C 

Air-ground logic units 

2 

2 

Mechanical surface input paths 

1 

2 


a The redundancy shown in the Test ACT column is that of 757 NA001. 
b The proposed fourth 28-V dc supply is a charger-floated battery. 
C The proposed fourth hydraulic system is a small dedicated supply. 
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10.2 CONTROL LAW SYNTHESIS 


10.2.1 OBJECTIVES 

A general objective of the PAS control system is to enable an unstable airplane to meet 
the Federal Aviation Regulations (FAR), Part 25, Airworthiness Standards for Transport 
Category Airplanes (ref. 11). In addition, PAS was required to satisfy the same gain and 
phase margin requirements that have been imposed on the production 757 autopilot. 
These are: 



Gain 

Phase 

Mode Frequency (f m ) 

Margin 

Margin 

(Hz) 

(dB) 

(deg) 

f m <0.06 

+ 3.0 

+20 

0.06 < f m < 1st aeroelastic mode 

+4.5 

+30 

f m > 1st aeroelastic mode 

+6.0 

+45 


The modal frequency of the first aeroelastic mode of the 757 is approximately 2 Hz. 

Additional constraints were applied to the airplane transient response to a step column 
input, as shown in Figures 44 and 45. The resulting pitch rate, normalized with respect to 
the steady-state pitch rate, was required to be within the specified boundaries. When a 
steady-state pitch-rate response to a constant column input does not exist, a certain 
amount of "engineering judgment" has to be used with this criterion. 

As described in Section 10.2.2, the normally operating PAS is referred to as the Primary 
PAS. A highly reliable submode, termed the Essential PAS, is also included to provide 
get-home capability in the event of Primary PAS failure. Both augmentation modes have 
been evaluated on a piloted moving-base simulator and were required to meet alternative 
flying quality standards, as expressed in Figure 4. The Primary PAS was expected to 
provide Level 1 flying qualities (defined in sec. 10.2.2.1) at all permissible center-of- 
gravity (eg) locations throughout the flight envelope. Similarly, the Essential PAS was 
required to be at least Level 3. 
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Pitch Rate/Steady-State Pitch Rate 


3.2 


Constraints: 



Time, sec 


Figure 44. Handling Qualities Criteria-Low-Speed Conditions 
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Pitch Rate/Steady-State Pitch Rate 



Primary PAS Handling Qualities Criteria 
Step Column Input 


Constraints: 

• The maximum undershoot should not exceed 
25% of the maximum overshoot. 

• When the maximum overshoot is less than 
20% of Q ss , the rise time from 0.10 to 
0.70 Q ss should not exceed 0.8 sec. 


Upper Boundary 


Desired Response 


Lower Boundary 


2 3 4 5 6 

Time, sec 


Figure 45. Handling Qualities Criteria-Cruise Conditions 
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Objectives for the wing-load alleviation (WLA) control system were less stringent. 
Whereas PAS was designed to be flight tested on a 757 airplane with artificially degraded 
stability, the WLA control law was developed principally to size the Test ACT hardware 
and software. Flight testing of WLA will be restricted to open-loop evaluation; i.e., servo 
commands will be derived from appropriate sensors but will not be used to drive control 
surfaces. 

10.2.2 METHODS 

10.2.2.1 Pitch-Augmented Stability Synthesis 

The production 757 has a eg range from 7% to 39% mean aerodynamic chord (MAC). PAS 
synthesis was based on the assumption that a similar but aft-shifted eg range would be 
required of an ACT airplane. The control law was therefore developed for the 757 with an 
assumed eg range of 20% to 50% MAC. Table 4 indicates the flight conditions at which 
PAS was evaluated. Included is a cruise flight condition with the eg at 55% MAC. This 
was added since it is the probable aft limit achievable with the projected eg control 
system to be used during flight testing. It is also the most unstable flight condition of 
those evaluated. 

PAS control laws were developed to provide the following features: 

• Partitioning into critical and crucial functions 
o Restoration of conventional stability 
O Fly-by-wire (FBW) control 

9 Authority limiting of the critical elements 

O Automatic offloading of long-term elevator commands to the stabilizer 
e Compensation for excessive stick forces when in a banked turn 

Partitioning Into Critical and Crucial Functions— Functional partitioning was selected to 
be compatible with the reliability requirements of Section 10.3. An underlying assumption 
was that it is not currently feasible to validate software with a confidence level that 
would satisfy an "extremely improbable" (ref. 11) failure requirement of 10 failures per 
flight hour. The crucial aspects of the stability augmentation, together with a minimal 
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Table 4. PASDesig 


HIGH-SPEED CONDITIONS 



Weight 

Altitude 


Condition 

10 3 kg (10 3 lb) 

10 3 m (10 3 ft) 

Mach 

CRU 1 

83.5 (184) 

10.7 (35) 

0.82 

CRU 3 

83.5 (184) 

10.7 (35) 

0.82 

CRU 4* 

83.5 (184) 

10.7 (35) 

0.84 

CRU 6 

83.5 (184) 

10.7 (35) 

0.84 

CRU 7 

83.5 (184) 

10.7 (35) 

0.84 

CRU 11 

74.8 (165) 

3.0 (10) 

0.46 

CRU 14 

83.5 (184) 

7.6 (25) 

0.50 

CRU 16 

83.5 (184) 

12.8 (42) 

0.82 

CRU 20 

83.5 (184) 

8.2 (27) 

0.86 

LOW-SPEED CONDITIONS 






EAS 

m/sec (kn) 

APP 4 

73.5 (162) 

0.30 (1.0) 

63.3 (123) 

APP 5 

89.8 (198) 

0.30 (1.0) 

68.9 (134) 

APP 6 

89.8 (198) 

0.30 (1.0) 

68.9 (134) 

APP 8 

73.7 (162) 

0.30 (1.0) 

68.9 (134) 

APP 11 

99.8 (220) 

0.30 (1.0) 

74.6 (145) 


Also WLA design flight condition. 


) 


) 


q c 

10 3 Pa (lb/ft 2 ) 

eg 

(% MAC) 

Remarks 

13.26 (277) 

20 


13.26 (277) 

50 


14.03 (293) 

20 


14.03 (293) 

50 


14.03 (293) 

55 

Probable flight test limit 

10.68 (223) 

50 

Maximum thrust condition 

6.51 (136) 

50 

1.2 V s 

9.48 (198) 

50 

1.2 V<- at maximum altitude 

21.4 (447) 

50 

v mo /m mo corner 

2.44 (51) 

50 

Landing flaps 

2.92 (61) 

20 

Landing flaps 

2.92 (61) 

50 

Landing flaps 

2.92 (61) 

50 

Go-around power 

3.40 (71) 

50 

Takeoff flaps 




level of FBW control, were therefore implemented in an analog Essential controller, with 
additional stability and control enhancement generated by a digital Primary control 
system. 

Primary PAS commands to the elevator are first transferred to the Essential controller so 
authority limiting of the digital signals can be implemented independently in analog 
hardware. 

Restoration of Conventional Stability— The principal stability augmentation requirements 
of the Test ACT System are restoration of acceptable short-period characteristics and 
speed stability. Pitch-rate feedback to the elevators is used to provide the former, with 
airspeed errors driving both elevators and the stabilizer to provide the latter. Control 
laws were developed using classical root locus techniques. The procedure is illustrated in 
Figures 46 through 48, which show the roots of the unaugmented airplane at a cruise flight 
condition and successive closures of pitch-rate and airspeed control loops. As shown in 
Figure 46, the principal result of shifting the aft eg limit from the production 757-200 
value of 39% MAC to a Test ACT location of 50% to 55% MAC is to convert the pair of 
short-period oscillatory roots into a pair of roots on the real axis. At a eg location of 50% 
MAC, one of these roots is unstable, with a time-to-double amplitude of 8 sec. Included 
in the figure are root location boundaries that correspond to various levels of predicted 
handling qualities. These are shown as "Levels 1, 2, and 3" and are defined as follows: 

o Level 1— Clearly adequate for the mission or flight phase evaluated 

o Level 2— Adequate to accomplish the mission or flight phase but with objectionable 
deficiencies 

• Level 3— Controllable but deficient for mission performance 

As shown in Figure 46, two types of boundaries are imposed on an airplane which has roots 
that split into the classical short-period and phugoid complex pairs. It is evident that the 
production 757 at its aft eg limit of 39% MAC meets the Level 1 short-period frequency 
requirement of at least 1.2 rad/sec and satisfies the damping requirement of f > 0.35. 
As the eg is moved aft, the criterion is not met, and pitch stability augmentation is 
required. 
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757-200 

Root Locus as eg Location Varies 



Figure 46. Effect of eg Location on Unaugmented Longitudinal Roots-Cruise 
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oj, Imaginary Part, rad/sec 



Figure 47. Effect of Pitch-Rate Augmentation at Aft eg Limit in Cruise 
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Figure 47 shows the effect of adding "lagged" pitch-rate feedback when the eg is at 55% 
MAC. In this case, the lag was provided by a first-order lag filter with a break frequency 
of 10 rad/sec. As pitch-rate feedback gain is increased, the unstable unaugmented root is 
driven toward the left half-plane but cannot be stabilized completely due to the "zero" at 
the origin. At the nominal pitch-rate feedback gain, Kqj = 1.25 deg/deg/sec for flaps up, 
the time-to-double amplitude has changed from 2.5 sec (unaugmented) to 12 sec 
(augmented), thereby meeting the Level 2 stability requirement. Note that the roots 
normally associated with the short period have been relocated (at nominal pitch-rate 
feedback gain) such that their frequency is 6 rad/sec. Although this is considerably larger 
than the Level 1 requirement of Figure 46, the higher value is necessary since the short- 
period response is no longer dominated solely by the short-period roots; i.e., the roots on 
the real axis now have significant residues. 

Figure 48 shows the effect of adding airspeed error feedback to the partially augmented 
system of Figure 47. As shown, the unstable root is stabilized at nominal gain, and a pair 
of complex roots, similar to the original phugoid roots, is restored. The airspeed error 
computation is derived in the digital control system and provides stability consistent with 
Level 1 handling qualities. The pitch-rate feedback of Figure 47 is provided by the 
Essential analog controller such that Level 2 handling qualities are ensured in the event of 
failure of the digital PAS. 

Fly-by-Wire Control— Control inputs to the elevator are derived from force sensors on 
both the pilot's and copilot's control columns. Because these fly-by-wire commands are 
the only means whereby column deflections are routed to the elevator, the FBW system 
must necessarily have full authority. This requirement tends to conflict with the need 
(discussed in the next paragraph) to limit the authority of the digital Primary PAS. If all 
of the required FBW gain scheduling resided in the Essential controller, the high- 
reliability requirements of this analog PAS would be difficult to meet. As a minimum 
requirement, the Essential PAS must contain sufficient FBW gain scheduling to retain 
adequate control after Primary PAS failure. Piloted simulation studies indicate that the 
minimum Essential FBW gain scheduling should consist of a two-state gain change, with a 
low gain when flaps are up and a higher gain when flaps are extended. The remaining gain 
adjustments are provided by the Primary PAS. The flaps-up gain is 0.034 deg of elevator 
per newton (0.15 deg per pound) column force and this increases to 0.10 when flaps are 
down. 



Authority Limiting of the "Critical" Elements— As mentioned previously, the control 
system architecture evolved on the assumption that protection must be provided against 
the possibility of generic digital control failures in which all channels simultaneously 
produce an erroneous hardover elevator command. Because the probability of this fault 
occurring cannot currently be quantified, the Primary PAS commands are limited in the 
Essential PAS. The criterion selected to size the authority limit was that at any flight 
condition and eg location within the normal operating flight envelope, the Primary PAS 
should not be capable of producing more than a lg increment in normal load factor in the 
3 sec following fault occurrence. It is obvious that Essential PAS reliability would be 
improved if this limiter could be implemented with a fixed value. Unfortunately, the 
limit value necessary for protection at high speeds is less than the maneuvering authority 
required at low speed. An acceptable compromise was found to be a fixed authority of 
+2.5 deg of elevator when flaps are up, and limits of +7 deg of elevator whenever the flaps 
are in any of the extended positions. 

Automatic Offloading of Long-Term Elevator Commands to the Stabilizer-Speed stability 
is obtained from the Primary PAS by computing an elevator command that is proportional 
to true airspeed "error." This error is first computed during climb-out and is initially 
referenced to the climb speed. Subsequently, the airspeed reference is updated each time 
the pilot activates the manual trim button. During periods of infrequent trim switch 
usage, the possibility exists that the elevator command from airspeed error could exceed 
the authority limit of the Primary PAS. Because this would cause the Primary PAS to be 
temporarily ineffective, the airspeed error signal is automatically offloaded to the 
stabilizer. This offloading occurs whenever the elevator command from airspeed error 
exceeds +0.5 deg. 

Compensation for Excessive Stick Forces When in a Banked Turn— One of the consequences 
of using pitch-rate feedback for short-period augmentation is that the steady-state pitch 
rate in a maneuver tends to be proportional to the applied control column force. Pitch 
rate associated with a symmetrical pullup maneuver is less than that for a banked turn 
maneuver of equal normal load factor. Therefore, to maintain identical stick-force-per-g 
characteristics in pullups and bank turns, pitch-rate compensation based on roll angle 
must be introduced. 



10.2.2.2 Wing-Load Alleviation Synthesis 


The WLA control laws were developed only to demonstrate the validity of the computer 
architecture and were not intended to confirm control law effectiveness. Nevertheless, 
sufficient analysis was done at a single cruise flight condition to verify the concept. 

Maneuver-Load Control— The maneuver-load control (MLC) system was designed to drive 
the ailerons such that wing bending moments are reduced during maneuvers. Normal load 
factor, as measured by the IRS, is used to command aileron deflections so that wing loads 
are transferred inboard when the airplane is out of trim. Gains were selected to fully 
utilize the effective range of aileron deflection when maneuvering at limit load (1.5g 
incremental). A 10-rad/sec low-pass filter was included to avoid exciting the wing first 
bending mode (at approximately 12.5 rad/sec). 

In a maneuver, the MLC-controlled ailerons deflect symmetrically to relieve wing 
outboard bending moments. With wings of high sweep, these aileron deflections can 
produce a significant pitching moment. To counteract this, the MLC aileron command is 
also used to apply elevator balancing deflections. 

Gust-Load Alleviation— The gust-load alleviation (GLA) system was designed to reduce 
gust loads by suppressing the wing first bending mode. The system uses wing-mounted 
accelerometers that sense accelerations normal to the wing and commands aileron 
deflections that produce mode damping. The accelerometers are located to minimize the 
sensing of elastic modes other than the first bending mode. Isolation from higher 
frequency modes was also obtained by including a 20-rad low-pass filter in the command 
path. 

10.2.3 RESULTS 

Table 4 indicates the flight conditions at which the PAS control law was evaluated. 
Because the WLA control law is presently a conceptual study only (as opposed to the PAS, 
which is intended to be flight proven), WLA was evaluated at just a single flight 
condition— condition CRU of Table 4. 
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10.2.3.1 Pitch- Augmented Stability 


Figures 49 through 51 summarize the Primary PAS stability margins at the flight 
conditions evaluated. Margins were calculated for each of the individual feedback loops— 
airspeed, pitch rate, roll and pitch attitude— and for the loops in combination. Only the 
most critical stability margins are plotted on the figures. Also included in the figures are 
the required gain and phase margin boundaries specified in Section 10.2.1. As shown, the 
Primary PAS provides adequate stability at all flight conditions, except for conditions 
APP 8 and APP 11. At APP 8, the low-frequency gain margin is -2.4 dB rather than the 
required -3 dB. Thus, if the loop gain at APP 8 were reduced by 3 dB, the airplane would 
have an unstable root with a time-to-double amplitude of 177 sec instead of being 
neutrally stable, as implied by the gain margin requirement. For a trimmed flight 
condition, this would be unacceptable. However, since APP 8 is an untrimmed 
"go-around-power" condition, the margin deficiency is not significant. 

APP 11 is a maximum weight takeoff condition. The configuration has speed stability but 
with only a -0.2-dB gain margin instead of the required -3 dB. This will not compromise 
the projected flight test program since takeoffs will be constrained to the nominal eg 
range of 7% to 39% MAC. Furthermore, it is questionable whether or not speed stability 
is meaningful at this flight condition, since at takeoff thrust the aircraft is untrimmed 
and accelerating. If required, the margin could be met for a production system by 
increasing airspeed error feedback by 35%, at the expense of a slight degradation in the 
pitch-rate response to column commands. 

Stability margins were not evaluated for the Essential PAS, since this PAS did not 
completely stabilize the airplane at most of the extreme aft-cg flight conditions. 
Because the Essential PAS is required to provide only "get-home" capability, the 
acceptability of this mode was determined by piloted simulation rather than analytical 
considerations. Results of the Essential PAS piloted simulation study are documented in 
Reference 9. 

10.2.3.2 Transient Response to Pitch Commands 

The pitch-rate responses to step column inputs were within the acceptable bounds of 
Figures 44 and 45 at all flight conditions, when the airplane is augmented with the 
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Primary PAS. Essential PAS responses were also within acceptable limits for all cases in 
which a "steady-state" pitch-rate response to a step column command could be estimated. 

Once a column command is removed (at t = 5 sec in fig. 52), the airplane, augmented with 
the Primary PAS, tends to return to the original trim condition required in FAR, Part 25 
(ref. 11), but with considerable overshoot in both attitude and speed. An additional pitch- 
attitude-error feedback loop was therefore included to improve the damping in the 
absence of column inputs. The prevailing pitch attitude when the column returns to the 
detent position was selected as the attitude error reference. In order that the airplane 
might return to the trim conditions existing prior to the column input, the loop included a 
washout circuit with a 5-sec time constant. 

The column forces required to produce an incremental load factor of "lg" are listed in 
Table 5 as a function of flight condition and eg location. Because no FAR requirement 
exists for this parameter, the production 757 airplane requirement was used as an 
objective for the Primary PAS. It states that "maneuvering stick force levels shall be 
between 133 and 356N (30 and 80 lb) at 1-g incremental load factor." A less restrictive 
objective of 67 to 490 N/g (15 to 110 Ib/g) was assumed for the Essential PAS. As shown 
in the table, these objectives were substantially met. Only two conditions were 
significantly out of range, and both of them related to the Primary PAS: CRU 7 at 102 
N/g (23 lb/g) and CRU 20 at 111 N/g (25 lb/g). Both of these conditions are at extremes 
of the probable test envelope. Although gain adjustments to bring these conditions within 
range can easily be made, this will tend to increase the maneuvering forces at more likely 
flight conditions. Although still within range, the more probable operating conditions 
would then approach 356 N/g (80 lb/g). Because piloted simulation results have indicated 
a preference for light column forces, the gain revision decision will be deferred to the 
flight test phase. For the unstable Essential PAS conditions (i.e., no steady-state column- 
force-per-g exists), the value of incremental load factor 3 sec after application of column 
force was used for the computation. 

Table 5 also lists the airspeed change per unit of column force for the Primary PAS. 

Federal Aviation Regulations, Section 25.173c (ref. 11), states that "the average gradient 

of the stable slope of the stick force versus speed curve may not be less than 1 pound for 

each 6 knots." This is equivalent to requiring AV/F nn |<0.7 m/sec (a kn/lhl in thn 

N 

table. As shown, the requirement was essentially met, with the only significant deviation 
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Figure 52. Response to a 5-sec Column Pulse 
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Table 5. Column- Force-per-g and Column-Force-per-knot Data 



eg 

F col/g 
N/g (lb/g) 

V/F C0 ! 

m/sec (kn/lb) 
N 

Flight 

Location 

Essential 

Primary 

Primary 

Condition 

(% MAC) 

PAS 

PAS 

PAS 

CRU 1 

20 

205 (46) 

178 (40) 

0.567 (4.9) 

CRU 3 

50 

102 (23) 

133 (30) 

0.717 (6.2) 

CRU 4 

' 20 

196 (44) 

173 (39) 

0.428 (3.7) 

CRU 6 

50 

80.1 (18) 

129 (29) 

0.405 (3.5) 

CRU 7 

55 

62.3 (14) 

102 (23) 

0.463 (4.0) 

CRU 11 

50 

182 (41) 

249 (56) 

0.567 (4.9) 

CRU 14 

50 

227 (51) 

191 (43) 

0.705 (6.1) 

CRU 16 

50 

107 (24) 

169 (38) 

0.382 (3.3) 

CRU 20 

50 

80.1 (18) 

1 1 1 (25) 

0.278 (2.4) 

APP 4 

50 

334 (75) 

285 (64) 

0.439 (3.8) 

APP 5 

20 

454 (102) 

298 (67) 

0.254 (2.2) 

APP 6 

50 

280 (63) 

258 (58) 

0.879 (7.6) 

APP 8 

50 

236 (53) 

205 (46) 

N/A 

APP 11 

50 

254 (57) 

182 (41) 

N/A 
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at flight condition APP 6 where the value was 0.88 m/sec (7.6 kn/lb). It was not corrected 

N 

because of the belief that it would result in excessive stability at other conditions— a 

potential problem not addressed in the FAR. Simulator results suggest that if AV/F co j is 

less than 0.23 m/sec (2 kn/lb), the speed feedback opposes pitch-rate commands from the 
N 

column such that the airplane is difficult to maneuver. 

10.2.3.3 Wing-Load Alleviation Performance 

The performance of the WLA was evaluated using Von Karman turbulence with an rms 
isotropic gust level (oqjj 5 j) of 7.3 m/sec (24 ft/sec). A summary of the system 
effectiveness is shown in Figures 53 and 54. Percent changes in the rms levels of 
incremental wing bending and torsion loads, with successive closure of the PAS, MLC,. and 
GLA control loops, are shown. The changes are referenced to the rms loads of the 
unaugmented airplane. Also shown is the increase in the peak incremental value of 
elevator and aileron displacement and rate. 

The data show that PAS alone yields a 12.7% decrease in the incremental bending moment 
near the wing tip (75% of wing span) compared to that for the unaugmented airplane. The 
peak incremental demands on the 757 elevator are 2.2 deg in displacement and 9.8 deg/sec 
in rate. Both figures are well within the capabilities of the elevator drive servos. 

Adding MLC to the PAS yields a 23.6% decrease in the outboard incremental bending 
moment, again compared to the value for the unaugmented airplane. This additional 
reduction in moment is obtained by symmetric deflection of the ailerons and has a 
minimal effect on elevator servo activity. The peak demand on the aileron is 7.0 deg, 
which is 58% of the trailing-edge-down authority limit at V^q. The rate demand is 
60 deg/sec, which exceeds the current 55-deg/sec no-load rate limit of the 757 aileron 
drive system. This level of exceedance is not significant due to the extremely low 
probability of occurrence of the selected gust level. 

As shown in Figure 53, the GLA system reduced outboard bending moments by approx- 
imately 5% but at the expense of a 10% increase in inboard torsion-an acceptable trade. 
However, the peak aileron rate rose from 60 to 173 deg/sec. It is therefore questionable 
whether or not this particular GLA design could be justified for a Production ACT System. 
It should nevertheless be adequate to meet the limited objectives of the WLA flight test 
program, which is concerned more with verifying system architecture than with validating 
WLA control laws. 
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Figure 53. Wing Loads in Turbulence Due to PAS and WLA Systems 
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Peak Incremental Control Surface Deflections and Rates 
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Figure 54. Control Surface Activity in Turbulence Due to PAS and WLA Systems 
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10.3 RELIABILITY 


As stated in Section 10.1, the reliability requirements, system and airplane schedule 
reliability, apply only to the Production ACT System. The Test ACT System is not 
configured to achieve such reliability nor can the projected flight test program be 
expected to provide assurance of Production ACT reliability. This must therefore be 
accomplished by the analytical methods of this section. 

The summary of Production ACT reliability requirements and predictions is as follows: 



Requirement 

Prediction 

Probability of loss of Essential PAS/FBW 
in a 1-hr flight 

1 x 10 -9 

0.69 x 10“ 9 

Probability of loss of Primary PAS 
in a 1-hr flight 

1 x 10“ 5 

0.16 x 10" 5 

Probability of loss of WLA 
in a 1-hr flight 

1 x 10' 5 

0.17 x 10" 5 

Number of interruptions per 

65 

53.7 


100 000 departures 

10.3.1 ESSENTIAL SYSTEM 

Basic Requirement— The Essential system is required to provide sufficient pitch control 
and augmented stability to permit continued safe flight and landing without exceptional 
pilot skill or strength after any failure condition that has not been shown to be extremely 
improbable (probability is less than 10 for a 1-hr flight) (sec. 4.1.4). The performance 
requirement of the Essential PAS is therefore to provide at least Level 3 handling 
qualities (as defined in fig. 4) over the normal operating envelope. At least Level 2 
handling qualities are to be provided over a restricted flight envelope that is sufficient for 
continuation to the scheduled destination. 

Design Consequences— In order to meet the reliability requirement using state-of-the-art 
electronic components, the Essential system was configured to be quadruply redundant 
and "brick walled" (i.e., each channel is completely independent of the others, from the 
sensors to the output of the secondary actuators). 
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Essential System Reliability— The calculated probability of total Essential system failure 
in a 1-hr flight is 0.69 x 10“9, as shown in Figure 55. 

The reliability analysis for the Essential system is based on the following assumptions: 

• Worst case ambient temperature of the equipment racks is 65°C. 

• One Primary computer has been failed for 25 flight hours prior to dispatch. 

• Dispatch is not permitted with a known failure in the Essential system. 

• Failure rates of components are as shown in Table 6. 

• Generic faults and false condemnations are considered negligible. 

Figure 55 shows four sources of failure for the Essential System. The major contributors 
to its failure (passive fault sequences leading to a "two-two split") refer to those failures 
that may not be detectable by the detent monitor during flight (table 7). The "two-two 
split" in a voted quadruple redundant control function is a possible failure pattern that 
defeats the normal failure detection and reconfiguration plan. Normally the first failure 
is identified by a three-versus-one vote and the discrepant channel is disconnected. A 
second failure is then detected by a two-versus-one vote. However, if two of four 
operating channels fail similarly and are detected simultaneously, the voter configuration 
is two versus two with no sure way of identifying the failed pair. This is the "two-two 
split." Such failures are detectable during preflight test. The rate of inhibiting failures 
of inline monitors is small— on the order of 10 “^ Q r 10“^ per hour. Consequently, even if 
the inline monitors are not retested for 30 000 hr (assumed airplane life), passive fault 
sequences involving inhibited inline monitors do not contribute materially to the 
probability of a two-two split. The 7.1 x 10"^ failure probability shown in Figure 55 is 
derived for passive faults for which there is no inline monitoring. The computation is 
conservative since not all combinations of undetected passive faults cause two-two splits. 
The conclusion that inline monitors are effective, despite 30 000-hr exposure times, is 
based on the assumption that the monitoring components are periodically tested. A 
preflight test of the spin monitor has been developed and has been assumed to be available 
for the Production ACT System. 

Another failure mode results where one or more channels are disabled by a soft detent and 
not detected because of a failed Primary computer. (The secondary actuators have a 
connect-disconnect feature that enables them to be selectively engaged to the summing 
link. Engagement results from applying hydraulic pressure to two pistons within the 
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Figure 55. Essential Function Fault Tree 
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Table 6. Essential Channel and Essential Computer Failure Rates 


Essential Channel 


Component or Function 

Failures per 
10^ flight hour 

Source 

Loss of electrical power 

0 a 

NASA CR-3519 

Loss of hydraulic power channel 

24 

757 estimate 

Servo (secondary actuator) 

32 

NASA CR-3519 

LVDTs (2) c 

14 

NASA CR-3519 

Engage logic (A9 card)* 3 

18 

Analysis 

Essential computer (A6 and A8 cards)* 3 

33 

Analysis 

Secondary power loss (PS total) c 

62 

Analysis 

Force transducers (2) 

22 

NASA CR-3519 

Gyro c 

50 

Gyro spec 

Gyro monitor/torquer 

7 

Analysis 

Total X E ss 

262 


Soft detent 

7 

d 

Inhibiting failure of inline monitors 

0.02 to 0.2 

Analysis 

Negligible. 

^Total component failure rate at 65°C. ambient. 


1 

! 

Q 

Components having inline monitors. 
^Factored from a Boeing piece-part analysis. 


1 

i 

Essential Computer 


Component 

Failures per 
10 6 flight hour, 
50OC 

Failures per 
10 6 flight hour, 
65°C 

Engage logic 
(A9 card) 

11 

18 

Computer 
(A6, A8 cards) 

14 

33 

Power supply 

42 

62 

Total 

67 

113 


132 





Table 7 . Rate of Passive Failures Causing 2-2 Splits 


Failures per 

Component or Function Classification 106 flight hour 


Hydraulic power 

A 

00 

Servo 

B 

1.1 

LVDTs 

C 

00 

Engage logic (A9) 

A 

00 

Power supply 

C 

00 

Force transducers 

C 

00 

Gyro (except pickoff) 

c 

00 

Gyro pickoff 

B 

1.0 

Gyro monitor torquer 

A 

00 


Subtotal 

2.1 


Estimate for Essential computations 

5.0 

Classification key: 

Total: 

7.1 

A A 2-2 split requires a 3-fault sequence. 

B Unmonitored and can lead to a 2-2 split. 

C Component has high coverage inline monitor. 



Vendor FMEA for similar equipment. 


power piston, causing them to clamp down on a roller on the output link, thus making the 

output link follow the power piston. Any fault that prevents the pistons from clamping 

down on the roller prevents engagement. This is called a "soft detent.") This failure 

-9 

combination contributes 0.26 x 10 to the probability of Essential system failure, under 
the assumption that a failed Primary computer at dispatch precludes soft detent detection 
and that the detent validation is waived for a maximum of 25 flight hours. In this case, a 
soft detent failure is not detected py the preflight check nor is it apt to be detected in 
flight. The figure of 25 flight hours is based on 757 and 767 minimum equipment list 
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(MEL) requirements for the Yaw Damper System, which allows dispatch with one channel 
inoperative for a maximum of 25 flight hours. 

The system, as a result of failure of three channels in flight, has a failure rate of 0.07 x 

_9 

10 per flight hour. 

Negligible failure probability has been assigned to a three-fault sequence involving 
preflight latent faults. It is assumed that any identified failure sequence of substance will 
require modification of the preflight test procedure so that the condition would be 
detectable. 

10.3.2 PRIMARY SYSTEM 

Basic Requirements— The Primary system, operating in conjunction with the Essential, is 
required to provide Level 1 handling qualities. Loss of the Primary system does not 
require diversion, although dispatch would not be permitted. Some change of flight 
parameters, such as speed or altitude, may be required. To improve the schedule 
reliability of this system without excessive redundancy, dispatch is permitted with any 
one of the following items inoperative: 

o One Digital Air Data System 
e One Inertial Reference System 

o One Primary Active Controls Computer 

The reliability requirement of the Primary system is such that the probability of complete 
failure of either the Primary PAS or the WLA shall be less than 10“^ in a 1-hr flight. 
Because loss of the Primary PAS or WLA affects only flight envelope modification, the 
failure probabilities are averaged over all dispatchable flights. 

Design Consequences— In order that the inflight requirements be met (with the predicted 
component failure rate), the Primary PAS must be capable of operating with only a single 
IRS or DADC. As discussed in Section 10.1, it is expected that this can be accomplished 
with inline monitors and authority limiters. It is believed that inline monitors can provide 
9596 coverage, where coverage represents the percentage of component faults that are 
correctly identified by the monitors and correctly reconfigured. 
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Calculated Reliability of Primary PAS/FBW— The failure rate of a Primary computer, 
excluding components dedicated to WLA functions, is estimated to be 22 x 10“^ per flight 
hour. This is based on the failure rates listed in Table 8. Applicable failure rate 
estimates from the 757 Autopilot/Flight Director System (AFDS) Program have been used, 
and the remainder have been obtained by analysis. 


Table 8. Primary Computer Failure Rate Estimate 


Computer Card 

Primary PAS/FBW 
Failure Rate 

Primary Computer 
Failure Rate 

Number - Function 

Per 10 b Flight Hour c,a 

Per 10° Flight Hour 

XI 

O 

< 

8.9 

8.9 

A3 - I/O b 

9.9 

9.9 

A4 - Analog in 

13.4 

13.4 

A5 - Analog output 

- 

14.2 

A5 - PAS/FBW only 

1.8 

— 

A7 - Monitors 

8.9 

8.9 

A 10 - X-channel receiver 

11.4 

11.4 

All - RAM 

30.7 

30.7 

A 12 - Logic 

- 

17.5 

A 12 - PAS/FBW only 

1.4 

— 

A 13 - I/O control* 3 

10.8 

10.8 

A 14 - I/O data b 

11.6 

11.6 

A15 - CPU control 

12.9 

12.9 

A 16- CPU data 

8.6 

8.6 

Program memory (30 000) 

38.8 

38.8 

Power supply a,b 

— 

42.1 

Power supply without 400-Hz 
inverter 

37.0 

— 

Interconnect 

18.3 

18.3 

Total 

224.4 

258.0 

Power supply is counted against Essential. 


Components in series with sensor. 

C ’ o 

At 50 C average equipment ambient. 



Excludes WLA-unique components and 400-Hz power supply for Essential computers. 
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Certain Primary computer failures can intercept the flow of data from local channel 
sensors to the other Primary computers. The involved components in Table 8 are 
computer cards A2, A3, A 13, A 14, and the power supply. To account for such failures, the 
approximate failure rate of these components (8 x 10“^ per flight hour) is added to the 
failure rate of each sensor (table 9). Failure rates so adjusted are indicated by an asterisk 
(e.g., X*IR5). 

The probability of total loss of Primary PAS/FBW functions is calculated to be 0.16 x lO - ^ 
for a 1-hr flight (fig. 56). Failures of the Primary computer do not contribute 
significantly to this value. 

Calculated Reliability of WLA— In Figure 57, the probability of total loss of WLA is 
calculated to be 0.17 x 10"^ for a 1-hr flight. Again, neither the Primary computers nor 
the dedicated sensors contribute materially to the result. The most significant 
contributor is the Inertial Reference System. 


Table 9. Airplane Sensor and Sensor System Failure Rates 


Component 

Failures Per 
10^ Flight Hour 

Inertial Reference System 

600 

Digital Air Data Computer 

290 

Inertial Reference System (IRS*) 

680 

Digital Air Data Computer (DADC*) 

370 

*The failure rates for IRS and DADC include the failure rate of input-output processing 
of their signals by the Primary computers. 
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Notes: 

a. It is assumed that dispatch may take place with one 
Primary PAS computer or one Inertial Reference System 
or one Digital Air Data Computer inoperative. The 
probability that no additional module is inoperable is 
one minus the probability that any additional module 

is inoperable. 

b. All failure rates (A's) are expressed per flight hour. 
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Figure 56. Fault Tree for Total Loss of Primary PAS 
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Figure 57. Fault Tree for Total Loss of WLA 
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10.3.3 SCHEDULE RELIABILITY 


Schedule reliability per the definition in Section 4.1.5 can be predicted in either of two 
ways: 

• By an analysis based on the probability of (1) a required ACT function being made 
inoperable due to failure of a component and (2) an interruption of service due to 
such failure 

• By comparison to interruption rates experienced in commercial service resulting from 
failure of components that are similar to the ACT components 

Although it is possible to compute probability, the variables such as (1) the time a 
malfunction occurs and (2) the available ground time (through-stop, turnaround, or 
overnight) to trouble shoot, repair, or replace— coupled with whether or not the flight crew 
will accept an airplane that is legally dispatchable with faults-make it a very 
cumbersome task with questionable results. 

The second method is based on actual airline service experience for components of similar 
function and deferrability. Deferrability refers to the use of the minimum equipment list, 
which identifies those components that can be inoperable without precluding dispatch. 
Previous experience has shown that the second method provides good predictions, and it is 
therefore used here. 

• Basic Requirement— The Production ACT System shall add no more than 65 
interruptions per 100 000 departures (sec. 4.1.5). 

• Calculated Schedule Reliability— The Production ACT System interruption rate is 
predicted to be 53.7 per 100 000 departures (table 10). 

Table 10 is a tabulation of the Production ACT components to be analyzed, the compo- 
nents currently in airline service chosen to approximate the ACT components, and 
the airplane types from which the experience interruption rates were obtained. Each ACT 
system component interruption rare is developed by factoring the data base component by 
the following factors: 
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Table 10. Schedule Reliability Calculation 


Name of Part Added to 
the Baseline Airplane 

Compar- 
ison j 

Airplane 

— , — ■ ■' | 

Comparison Part, Name 

Number 

per 

Airplane 

Factor 

Flight 

Length 

Factor 

Failure 

Rate 

Factor 




A 

B 

C 

Essential Computer 
and Dedicated Pitch- 
Rate Gyro 

! 

DC-10 | 

Digital Air Data 
Computer 

4/2 

0.625 

67/98 

Elevator and Aileron 
Secondly Actuators 
(Note 2) 

747 

Elevator PCU ^ 

i 

8/4 

0.510 

32/17 

Flap Position 
Sensor 

747 

Flap Position Sensor 

4/2 

0.510 

5/5 


Column Force 
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Preflight Test 
Panel 


Control Panel 


DC-10 Digital Air Data 

Computer 

DC-10 Digital Air Data 

Computer 

DC-10 Digital Air Data 

Computer 


8/2 0.625 


1/2 0.625 


1/2 0.625 


2 

(Note 1) 


Interruptions Per 
100 000 Departures 

Comparison 

ACT 

Part 

Part 
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F=A*B*C-D*E 
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for Rate Gyro or 
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Primary ACT 
Computer 


DC-10 Digital Air Data 
Computer 


Note 1 A deferrability factor other than one is provided to account for those instances where the 
comparison part has a different MEL requirement than does the 
production ACT component. 

Note 2 Wing-mounted accelerometers will have sufficient 
dispatch flexibility to be considered negligible 
contributors to schedule unreliability. 


0.5 

(Note 1} 


All DADCs Required 
for Dispatch; One 
Primary Computer May 
Be Inoperative 
Under MEL 


Component Total 

41.3 


System 

(1.3 x Component Total) 

53.7 



) 


) 


) 









































• Number per Airplane Factor— The ratio of the number of components in the ACT 
airplane to the number of similar components in the experience data base. 

• Flight Length Factor— Determined for the 757 and 767 Programs, it assigns a ratio of 
time versus cycle-related failures for each two-digit AT A classification and provides 
a formula for adjusting data base flight lengths to the flight length of the airplane 
under study. The flight length of the airplane under study is assumed to be 1.25 hr 
and is consistent with the expected average flight of the 767 and 757 fleets. 

• Failure Rate Factor-The ratio of the anticipated failure rate of an ACT component 
to the experienced failure rate. 

• Deferrability Factor— A correction to allow for the fact that the ACT airplane 
component and the reference airplane component are not treated alike by the MEL. 

The sum of the interruption rates for each of the listed components represents those 
interruptions that are traceable to the particular ACT components. Experience has shown 
that all schedule interruptions for an automatic flight control system are approximately 
equal to 1.3 times the sum of all interruptions traceable to particular components. To 
account for this, the ACT System totals are computed at 1.3 times the sum of the 
components. 
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11.0 TEST PLANNING 


Testing of the Test ACT System will be performed in two phases. The first will take 
place in an avionics laboratory and a flight control test rig and will determine readiness 
for flight tests. The second phase will be a flight test that will demonstrate the 
performance and safety of the Test ACT System in a relaxed static stability-configured 
airplane. 


11.1 LABORATORY TEST PLAN 

The primary objective of the Test ACT System laboratory tests will be to verify and 
validate the system hardware and software in time to support the flight test currently 
scheduled for 1985. The majority of the laboratory testing will be performed in the 
Boeing Digital Avionics Flight Controls Laboratory and a Boeing flight control test rig. 
Other testing was performed by Collins in Cedar Rapids. The testing at Collins verified 
that the system, as designed, meets the requirements; the testing at Boeing will validate 
most of these requirements and prove the system is safe for flight. 

The activities covered by the Laboratory Test Plan include tests of system hardware and 
software, as well as system integration. The testing begins with the delivery of the Test 
ACT Console (TAC) and system hardware and progresses through troubleshooting and 
updating of hardware and software, as required to show full readiness for the flight tests. 

11.1.1 LABORATORY TEST DEVELOPMENT AND SCHEDULE 

11.1.1.1 Buildup in Test Complexity 

The laboratory test features a programmed buildup in the completeness and complexity of 
the test setup. Starting with single-channel testing of an analog Essential computer, the 
testing will build in complexity by slowly adding multiple channels, the digital Primary 
computers, an airplane simulation, and finally a pilot with a simulated flight deck, 
moving-base cockpit, and computer-generated imagery. 

The earlier, simpler tests will be performed using general-purpose test equipment under 
the control of an Eclipse S250 computer. In this case the Eclipse simply automates the 
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testing. As the tests grow in complexity, the Eclipse will be used to simulate airplane 
sensors and then the airplane dynamics themselves. At the highest levels of complexity 
(i.e., those involving a pilot), the tests will switch to a Harris Series 800 computer that 
will provide a higher fidelity model of the airplane aerodynamics, as well as provisions for 
interfacing with the pilot and a flight deck simulator. 

11.1.1.2 Test Design and Development 

Review and analysis of system requirements documentation and the supplier's design and 
verification documentation will be used to develop a test matrix. This matrix will be used 
in turn to design the test cases (Plans of Test) for which procedures will be developed. 
The test cases will be chosen in a manner that covers the requirements in a balanced 
fashion, with a minimum of duplication of previous verification testing. Plans of Test, as 
well as Detailed Test Procedures (DTP), will be developed prior to the beginning of trial 
test runs and finalized prior to the formal test runs. 

The design and development process for step-by-step procedures, test drivers, comparison 
checkers, and analytical programs will continue through the test period. The DTPs will 
become more specific as familiarity with the laboratory facilities and operational 
procedures increases; then the Plans of Test will be updated. 

11.1.1.3 Analysis and Review 

The analysis and review step of the test design process is critical to the selection and 
preparation of detailed tests that will adequately examine the features of the Test ACT 
System within the constraints of time and other fixed resources. 

The test analysis task begins with the development of laboratory test categories and the 
determination of potential system error classifications. These will serve to direct and 
order the test design effort. The next step is the preparation of a test matrix, relating 
documented requirements to planned tests. This effort is intended to ensure that no 
stated requirement goes untested. Further, it will aid in avoiding unnecessary duplication 
of tests. The test matrix is also expected to provide insight into retest requirements of 
new versions of the system, following revision or problem correction. 
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11.1.1.4 Laboratory T est Categories 


The design of the test cases and the overall planning of the testing is aided by initially 
dividing the requirements that must be tested into logical categories. These categories 
will provide the first-level organization for the development of the test cases (Plans of 
Test). 

A set of categories that meets the needs of the Test ACT System laboratory test effort 
follows: 

• Open-loop hardware tests 

• Open-loop software tests 

• Failure detection tests 

• System integration tests 

• Closed-loop system performance tests 

• Closed-loop failure response tests 

Table 11 illustrates the test categories and their contents, as envisioned for the Test ACT 
System laboratory tests. 

11.1.1.5 Test Matrix 

The test matrix for each category will be developed by examining the requirements 
defined by the Test ACT Specification Control Drawing. In addition, supplier design and 
implementation documents will be examined for requirements generated by the system 
design process. The specification paragraph number will be used to cross-reference the 
various documents with the test matrix. 

11.1.1.6 Development of Test Procedures 

The general test philosophy will be first to verify that the system meets all requirements 
given in the Specification Control Drawing and then to determine that they result in a 
safe system that meets the performance requirements. To ensure this, the matrix 
described in Section 11.1.1.5 will be used. It will indicate how each requirement will be 
met (inspection, analysis, or test) and who (the vendor or Boeing) will perform the test. 
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Table 11. Laboratory Test Plan Categories 


OPEN-LOOP HARDWARE TESTS 

• EMI, power transient, and quality susceptibility 

• Control panel operation 

• Input/output interface 

• Primary system hardware monitors 

• Essential control laws 

• Essential PAS/FBW monitors 

• Primary system output voting 

OPEN-LOOP SOFTWARE TESTS 

• Flight deck interface 

• Pitch control laws 

• Wing-load alleviation 

• Signal selection and fault detection 

• Output management 

• Program control 

• Fault reporting and recording 

FAILURE DETECTION TESTS 

• Power-up 

• Preflight 

• Periodic tests/monitors 
SYSTEM INTEGRATION TESTS 

• Test ACT/DADC integration 

• Test ACT/IRS integration 

• Test ACT/CSEU/FSEU integration 

e Test ACT/secondary actuator integration 

CLOSED-LOOP PERFORMANCE TESTS 

• Closed-loop stability and response (unpiloted) 
o Closed-loop stability and response (piloted) 

CLOSED-LOOP FAILURE RESPONSE TESTS 

• Airplane response to failures (unpiloted) 
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Each requirement to be tested by Boeing will be covered by at least one DTP. In general, 
each of them will verify several requirements. 

The DTP will be developed in three parts or steps. Step one, as explained previously, is to 
identify the requirements to be verified. Step two will be to write a short description of a 
test that will verify those requirements. Step three, which will be performed in the 
laboratory, will be to determine the procedures required to perform a repeatable test (a 
primary requirement on DTPs is that they contain enough information to repeat the 
procedure years later). It is in this period that the computer programs used to automate 
the test will be developed for the Eclipse. 

1 1 . 1 . 1 .7 Test Schedule 

Figure 58 gives the schedule for the initial phase of laboratory testing. Laboratory 
development and test planning will proceed concurrently. Both are scheduled to be 
complete on duly 6, when the Test ACT hardware and software arrive from Collins. At 
that time laboratory testing will begin. This phase of laboratory testing will be completed 
by mid-December 1983. The need for system changes will be determined at that time. 

Figure 59 is the full-term schedule. Test planning for 1984 is only preliminary, as the 
data for software update and actuator availability are not firm. The major test events for 
1984 are a test of the four actuator interconnectors and validation of the final Test ACT 
Configuration. 

11.1.2 LABORATORY FACILITY DESCRIPTION 
11.1.2.1 Digital Avionics Flight Controls Laboratory 

All tests will be conducted at the Digital Avionics Flight Controls Laboratory (DAFCL). 
This laboratory is located adjacent to the Renton Flight Simulation Center (RFSC). The 
primary function of the DAFCL is 757/767 flight control system validation, although 
support is also provided to advanced technology programs, such as Test ACT, and to 
software development. The laboratory layout is shown in Figure 60. 
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Figure 58. Test ACT System Laboratory Test Schedule 
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Figure 59. Overall Test Schedule 
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Digital Avionics Right Controls Laboratory 



Computers 

TMS: Thrust Management System 

PAS/D: Pitch Augmented Stability Demonstrator 

Figure 60. DAFCL Laboratory Layout 
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The DAFCL contains work areas with digital simulation hardware, test consoles, analog 
computers, interface equipment, and other support hardware. The ability is provided to 
conduct real-time simulations with simulated control inputs. The complex can be 
interconnected with the RFSC for testing with crew cabs and maximum fidelity 
aerodynamic models. 

11.1.2.2 Digital Avionics Flight Controls Laboratory Simulations 

The DAFCL Data General Eclipse S250 computers host simulations of the airplane 
equations of motion, sensors, servos, airplane environment, and engine dynamics. The 
sensor and servo simulation will include proper timing, scaling, and significant 
nonlinearities. 

The Eclipse aerodynamic model is derived from the maximum fidelity aerodynamic models 
used in the RFSC. This process provides good configuration control of airplane data. The 
Eclipse computers will be used in the early phases of testing to (1) provide an automated 
test sequence, (2) record test results, (3) simulate sensors and actuators, and (4) provide 
input and output simulation and failure models. 

11.1.2.3 Renton Flight Simulation Center 

The Renton Flight Simulation Center contains all components necessary to conduct man- 
in-the-loop, real-time aircraft simulations. The components include (1) digital and hybrid- 
analog computers, (2) cockpits with instrument displays, (3) computer-generated cathode 
ray tube (CRT) displays, (4) visual displays, (5) a cockpit motion system, (6) an extensive 
computer software library, and (7) an experienced simulation staff. The floor plan and 
location of major elements of the RFSC are shown in Figure 61. 

The Multipurpose (M2) Cab is equipped with a three-degree-of-freedom motion base and 
an electrohydraulic force feel system. The M2 cab can be configured to represent any 
Boeing commercial airplane. The cab has a complete captain and first officer 
instrumentation set, modular aisle stands and dash panels, test conductor's station, and 
out-the-window visual displays. The Guidance and Flight Display Cab and the Systems and 
Work Load Cab are commonly called Configuration (C) Cabs. The C cabs support the 757 
and 767 Programs. Included in the cabs is a complete digital interface system to the 
RFSC laboratory computers. 
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Figure 61. Boeing-Renton Flight Simulation Center 
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A high-fidelity, fully nonlinear 757 simulation model, resident in Harris Series S00 
computers, is provided in the RFSC. This facility will be used for system integration and 
piloted simulation work in support of this test plan. The simulation cab facility is used for 
tests that require pilot-in-the-loop control and display interaction. Most piloted 
simulations will utilize the fixed-base C cab for system integration testing since that cab 
configuration closely matches the cockpit layout of the 757 flight test airplane. The 
moving-base M2 cab will also be used to a lesser extent, where motor cues are important. 

11.1.2.4 Renton Flight Control Systems Hydromechanical Laboratory 

The Renton Flight Control Systems Hydromechanical Laboratory (RFCSHL), located 
adjacent to the DAFCL (fig. 60), is used for development, verification, and validation 
testing of aircraft actuators and mechanical fixtures. The laboratory contains complete 
electrical and hydraulic fluid distribution systems with convenient connect points. Large 
environmental test and fluid flow benches are available, as is a protected operator control 
and data gathering room. 

Future plans call for building a special test fixture (mini-rig) in the RFCSHL to test the 
servoactuators in a four-channel closed-loop configuration. This mini-rig will simulate 
the mechanical interconnections between the actuators that will exist on the test 757 
airplane. These actuators will be controlled, through the work station interface (WSI), by 
the Active Controls Computers (ACC) located in the adjacent DAFCL. 

11.1.3 TEST SUPPORT HARDWARE AND SOFTWARE 

11.1.3.1 Digital Avionics Flight Controls Laboratory Test Support Equipment 

In addition to the simulation host computers, the other equipment required for DAFCL 
testing is shown in Figure 62. The major elements are described as follows: 

• A front-end processor (Data General Eclipse S230) is provided with each simulation 
host. It has the capability to format the floating-point simulation data to or from the 
equivalent fixed-point format that is compatible with the line replaceable unit (LRU) 
interface equipment. 
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• Analog Computer 

* IEEE 488: Institute of Electrical and Electronics Engineers’ 
data transmission standard 


Figure 62. Typical DAFCL Test Configuration 
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• A WSI is provided for interfacing the Primary and Essential computers and TAC with 
the rest of the laboratory. This device controls the buffering, conversion, signal 
conditioning, and other required LRU interfacing. A patch panel is provided for 
flexible interconnection to the TAC. 

• A Simulation Control Console is provided for the test conductor interface. This 
console includes a simulation control CRT and a panel of programmable controls and 
displays (discrete switches, lamps, rotary input encoders, and numerical displays). 

Figure 63 illustrates the interfacing required for the Test ACT work station. 

11.1.3.2 Digital Avionics Flight Controls Laboratory Support Software 

The DAFCL support software will include a real-time simulation and test executive, 
plotting routines, test driver software (e.g., frequency response test), interface software 
and data bases, diagnostic software, and analysis programs. The real-time simulation and 
test executive is a higher order language within which simulation models and open-loop 
test drivers are combined to form a simulation package. It also provides a standard user 
interface for simulation initialization, control, and data acquisition. 

Supporting aids, such as LRU and Aeronautical Radio Incorporated (ARINC) data bases, 
high-fidelity LRU models, comparison checkers, problem tracking, and report generation 
capabilities, are also provided. 

11.1.3.3 Work Station Interface Patch Board Preparation and Checkout 

The test area of the DAFCL includes a WSI patch board development and checkout bench, 
consisting of a work area and a microcomputer-based automatic patch board checkout 
station. A patch board configuration control program is provided for interactive 
maintenance and control of the patch configurations and for downloading the patch data 
base for the checkout station. 
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Figure 63. Test ACT Work Station 
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11.2 FLIGHT CONTROL TEST RIG TEST PLAN 


Test ACT System and proof testing will be performed on the 757-200 Flight Control Test 
Rig (FCTR) prior to installing the system in the airplane. 

11.2.1 FLIGHT CONTROL SYSTEM TEST 

All mechanical and actuation components of the Test ACT System will be installed in the 
FCTR and integrated with the normal airplane systems. The function of the ACCs will be 
simulated by laboratory test drivers. 

The objectives of the test are to: 

• Verify elevator rate and deflection capability 

• Determine system resolution in terms of deadband and hysteresis 

• Determine frequency response characteristics 

• Determine effects of asynchronous computer operation 

• Determine system engage and disengage characteristics 

• Determine system transient characteristics in response to failures 

11.2.2 PROOF AND OPERATIONS TEST 

A one-time limited mechanical and hydraulic system proof and operations test will be 
conducted. This will be used to verify proper operation and adequate structural capacity 
of Test ACT elements for operating modes that are beyond the scope of the system 
functional test. This will subject Test ACT components, supports, and plumbing to limit 
or near-limit load conditions. Component operating clearance under extra-normal 
conditions, such as combined mechanical and electrical commands, will be verified. 

The above testing will be conducted on the FCTR wherever practicable, with the 
remainder accomplished upon the 757 airplane prior to first flight. 
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11.3 PRELIMINARY FLIGHT TEST PLAN 


This section presents the Preliminary Plan for the testing of the Test ACT System after 
installation in the test airplane. The plan includes engineering ground tests, as well as the 
actual flight test. 

11.3.1 TEST OBJECTIVES 

The objectives of the engineering ground tests are to verify: 

• Correct operation of the installed Test ACT System 

• Correct operation of the flight test instrumentation system 

• Flight test operational procedures and overall flight readiness before proceeding to 
the flight test phase 

The objectives of the flight tests are to validate: 

© The performance and safety of the Test ACT pitch fly-by-wire (FBW) and stability 
augmentation system on a test airplane configured for relaxed static stability 

© The open-loop performance (sensor-to-control surface command signal) of the Test 
ACT wing-load alleviation (WLA) system 

11.3.2 TEST AIRPLANE DESCRIPTION 
11.3.2.1 General Description 

The test airplane will be the Boeing-owned 757 (NA001). It is a new-generation, subsonic, 
commercial transport aircraft, as shown in Figure 64, that will be powered by two Pratt & 
Whitney 2037 high-bypass-ratio turbofan engines. Its longitudinal control surfaces include 
full-span elevators and trimmable horizontal stabilizer. The principal characteristics of 
the aircraft are summarized in Table 12. 
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Table 12. Principal Characteristics of the Test Airplane 



Metric Units 

English Units 

Maximum taxi weight 

100 236 kg 

221 000 lb 

Maximum takeoff weight 

99 792 kg 

220 000 lb 

Maximum landing weight 

89 813 kg 

198 000 lb 

Maximum zero fuel weight 

83 462 kg 

184 000 lb 

Engine thrust 

P&W 2037 

156 kN approx. 

35 000 lb approx. 

Passenger capacity— typical 

Mixed class 

178 

178 

All tourist 

196 

196 

Fuel capacity 

41 180 liters 

10 880 U.S. gal 

Cargo capacity 

All bulk 

52.11 m J 

1 840 ft-* 

Maximum operating speed 

CAS 

180 m/s ec 

350 kn 

Mach number 

0.86 

0.86 
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11.3.2.2 Ballast System 


The test airplane has a system of movable ballast enabling the center of gravity (eg) to be 
placed anywhere between 7% and 39% mean aerodynamic chord (MAC), the normal 
airplane eg range. Fixed ballast will be added to shift this range aft in order to attain 
55% MAC. A description of the planned ballast system is presented in Appendix A. 

11.3.2.3 Flight Test Instrumentation 

The flight test instrumentation system consists of both airplane- and ground-station-based 
equipment. The airplane equipment provides a data acquisition function by recording 
selected test data from various airplane subsystems and formatting the data as desired for 
real-time monitoring. A telemetry link with the ground station allows real-time 
monitoring of system performance during minimum crew flights. Recorded data include 
subsystem performance parameters and pertinent aircraft states that are available for 
engineering evaluation after postflight processing. 

Test ACT System parameters available within the ACCs will be transmitted to flight test 
instrumentation via ARINC 429 digital data buses. Real-time monitoring capability of 
Test ACT performance will be provided via CRT displays, hard copy printers, x-y plotters, 
strip chart recorders, and frequency spectrum analyses. 

11.3.3 GROUND TEST PLAN 

Engineering ground tests will be performed to verify that the new and modified systems 
associated with the Test ACT System function as intended. Functional and vibration tests 
will be performed. Additionally, operational procedures relative to control system 
reconfiguration and possible emergency scenarios will be verified. 

11.3.3.1 Functional Tests 

Functional tests wll be performed to verify correct operation of the modified primary 
longitudinal flight control system, the FBW and pitch augmentation control system, the 
WLA system, the eg management system, and the flight test instrumentation and data 
acquisition system. 
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11.3.3.2 Ground Vibration Tests of Test Airplane 


Ground vibration testing will be performed, if necessary, to verify that the Test ACT- 
configured airplane with the most aft eg does not have any unexpected or undesirable 
characteristics compared with the basic airplane. 

11.3.3.3 Operational Procedures 

Data Acquisition and Display— Procedures for acquiring and displaying system and airplane 
performance data from the test instrumentation system will be verified. 

Flight Program Changes-Procedures for reconfiguring the Test ACT control laws via the 
flight test programmer will be verified. 

Cg Management— Procedures for managing the location of the airplane eg by means of the 
ballast system will be verified under both normal and emergency operating conditions. 

Control System Reconfiguration— Procedures for shifting from the normal primary flight 
control system operation to Test ACT System operation, and vice versa, will be verified. 

11.3.4 FLIGHT TEST PLAN 

The objective of the Test ACT System flight test is to validate the performance and 
safety of the Test ACT pitch FBW and stability augmentation system and the open-loop 
performance of the WLA system. 

11.3.4.1 Test Scope 

The scope of the flight test will include the following: 

• Evaluation of relaxed stability airplane longitudinal handling qualities with the Test 
ACT System not operating 

• Development of the active control system, using the provisions for inflight software 
program changes 
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• Evaluation of the active control system stability and performance 


• Evaluation of relaxed stability airplane longitudinal handling qualities with the Test 
ACT System operating 

• Validation of the Test ACT System fault tolerance and safety 

11.3.4.2 Test Ground Rules and Assumptions 

Prior to flight test, the following will have been completed: 

• All flight test conditions and tasks will have been simulated in the 757 engineering 
flight simulator. A summary of predicted flight test performance will have been 
prepared for use during real-time evaluation of flight test results. 

• Engineering ground test of the Test ACT and associated systems will have been 
completed. 

The flight test plan assumes the following: 

• Dedicated flutter testing will not be required. The airplane will be operated well 
within flutter placards. Flutter engineers will monitor closed-loop testing for 
absence of system coupling with airplane elastic modes. 

• The WLA subsystem will have sensors and computers operational, but no actuators 
will be installed. The operation of the sensors and control law performance will be 
monitored, but no dedicated flight tests will be conducted for WLA. 

• Initial flight tests will be performed with a minimum crew, necessitating 
telemetering of flight test data to a ground station for real-time monitoring and 
evaluation by the engineering team. Subsequent tests will have Test ACT and Flight 
Test Analysis engineers on board. 

• Access to the ACC software programs via the TAC keyboard will be prohibited in 
flight. 
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• Loading of alternate, previously verified, control law software modules will be 
allowed during flight. 

• System fault tolerance will be verified by inserting simulated faults at the TAC 
interface. However, actual initiation of the fault will be controlled by the pilot. 

• The greater part of the testing will be performed at aft eg locations that are 
controllable via the mechanical reversion system, in the unlikely event that the 
augmentation function is lost. The final phase of testing will evaluate "flight crucial" 
conditions after the reliability and fault tolerance of the system have been 
demonstrated. 

11.3.4.3 Detailed Flight Test Phases 

The flight test will consist of four phases: 

1. Determination of handling qualities of the unaugmented and augmented airplane at a 
benign flight condition; system development to correct any shortcomings discovered 
during flight test 

2. Continuation of phase 1-type testing but with the flight envelope expanded to include 
most critical flight conditions up to v mc/ M MO and max i munn c 8 locations that 
allow safe control unaugmented; testing of takeoff, landing, and cruise configurations 

3. Demonstration of Test ACT System fault tolerance 

4. Demonstration of handling qualities with the eg location moved farther aft such that 
the Test ACT System is performing a flight-crucial function; i.e., one required for 
safe flight 

11.3.4.4 Flight Test Results 

Flight test results will be appropriately documented to describe the flight performance of 

the Test ACT System. 
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12.0 CONCLUDING REMARKS 


The objectives of the Integrated Application of Active Controls (IAAC) Project were 
threefold: (1) to establish a credible assessment of the potential benefit of Active 
Controls Technology (ACT) applied to a commercial transport, (2) if there were a positive 
potential benefit of ACT, to identify the risks that preclude its use today, and (3) to 
initiate test and development activities to reduce the risk of such applications in a 
commercial transport. The first two objectives have been accomplished; the third is well 
under way with the completion and delivery of the Test ACT System described herein. 
The test and development work necessary to prepare the ACT technology (represented by 
this experimental system) for commercial application is just beginning. 

12.1 TEST ACT SYSTEM STATUS 

The Test ACT System, consisting of flightworthy hardware and software, was designed to 
represent a potentially certifiable system. It implements the following active control 
functions: 

• Pitch-augmented stability 

• Wing-load alleviation, including maneuver-load control and gust-load alleviation 

Since the system is necessary for continued safe flight, a natural adjunct to the ACT 
system is the use of fly by wire for control. Therefore the Test ACT System implements 
both control and augmentation through the use of fly by wire. 

Collins Air Transport Division of Rockwell International was selected to fabricate the 
Test ACT System equipment, including all system sensors. The following equipment was 
built, verified, and delivered: 

• Four Active Controls Computers 

• One Test ACT Control Panel 

• One Preflight Test Panel 

• One Flight Test Programmer 

• Four pitch-rate gyros 

• Two column force transducers with quadruple pickoffs 

• Eight linear accelerometers 

• One Test ACT Console 
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12.2 FUTURE WORK 


The test phases began with installation of the electronics in the Boeing Digital Avionics 
Flight Controls Laboratory and will proceed through addition of the servos, installation of 
the servos and associated mechanisms in a Flight Control Test Rig ("Iron Bird"), and 
installation and flight test in a Boeing-owned test airplane. This extensive laboratory and 
flight test of the Test ACT System will identify solutions for the technical risk areas as a 
step toward validating and establishing confidence that such a crucial system can be 
developed for a commercial application. 
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APPENDIX A 

757 NA001 CENTER -OF-GRAVITY MANAGEMENT FOR TEST ACT 


A.l GENERAL 

The Test ACT System will be flown at center-of-gravity (eg) positions considerably aft of 
the certificated limits for the 757 aircraft. In order to achieve the desired aft eg limits 
for flight and remain within the certificated limits for takeoff and landing, a system of 
fixed and movable ballast is incorporated. This system provides a eg forward of 39% 
mean aerodynamic chord (MAC) for taxi, takeoff, and landing and enables a rearward shift 
to 55% in flight. 


A.2 TEST ACT BALLAST SYSTEM 

The ballast system used is shown schematically in Figure A-l. The 757 Test Configuration 
is achieved by removing passenger seats, aft lavatories, and passenger-related items. All 
galleys except for the forward one, the class divider, and miscellaneous storage provisions 
are removed. Flight test instrumentation racks plus 20 seats for test personnel are 
installed. Approximately 6800 kg (15 000 lb) of fixed ballast, consisting of 23-kg (50-lb) 
sand bags, are placed on the floor of the main deck and in the lower cargo compartments. 
Center-of-gravity control during flight is accomplished by means of fore and aft water 
barrels on the main and cargo decks; pumps and interconnecting plumbing are provided for 
fore and aft wake transfer. 


A. 3 CENTER-OF-GRAVITY CONTROL 

Figure A-2 shows the gross weight— eg diagram for the Test ACT 757 Configuration. The 
eg for the operating empty weight is seen to be well forward of the certificated aft limit, 
but loading the fixed ballast moves it to approximately that limit. The water ballast 
system then allows the eg to be varied from within the certified limits for takeoff and 
landing to 55% for flight testing. 

Fuel only slightly affects the airplane eg, which ensures reasonable test duration for each 
selected eg location. 
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Figure A-1. Test Airplane Center-of-Gravity Control 
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Figure A-2. Test Airplane Gross Weight-Center-of-Gravity Diagram 
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Test ACT Extended Aft Limit 
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APPENDIX B 

ELEVATOR CONTROL LINKAGE HYSTERESIS TESTS 


This appendix reports on tests run in the 757 Flight Control Test Rig (FCTR, "Iron Bird") 
facility. The tests investigate the hysteresis of the left elevator control linkage between 
the aft quadrant and the middle power control unit (PCU) to evaluate its effect on 
operation of the Active Controls Technology (ACT) fly-by-wire system proposed for 
testing on NA001. 


B.l TEST ASSEMBLY 

The system tested was the complete elevator control system. The following special 
equipment was installed: 

• Elevator surface protractor 

• Feel computer pneumatic system 

• . Rig pins 

These two procedures were executed per 757 specifications before the hysteresis runs 
described in the following: 

• Elevator system rigging 

• Elevator system functional test 

B.2 TEST PROCEDURES 

Refer to Figure B-l for the following test procedures used during the 757 Iron Bird 
hysteresis investigations. 

Test runs 1 through 5 were made to investigate the effects of proper tightness of 
fasteners in the control system linkages under test. Runs 1 and 2 checked total hysteresis 
(pitch autopilot input voltage versus elevator trailing-edge angle) and control linkage 
hysteresis (movements of aft quadrant versus middle PCU input lever) before tightening 
the fasteners in the linkage to the proper torque values. Runs 3 through 5 repeated the 
test after adjusting the linkage fasteners. All of these tests are grouped together and 
labeled "TEST A" in Table B-l. 
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Figure B-1. Test Configuration, FCTR Control Linkage Hysteresis 
Measurements, Elevator System-Left Side 
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Table B-1. Hysteresis in 757 Elevator Control System 


RUN NO. 

s t 

PERIOD 

AMPLITUDE 

HYSTERESIS 

HYSTERESIS 

SYSTEM 

COMMENTS 


(deg) 

(sec/cycle) 

(deg S E ) 

AVERAGE OF 

MEASURED 

CONFIGURATION 






RUNS (deg * E ) 

BETWEEN d 




TEST “A” RETORQUING LINKAGE JOINT BOLTS 


1&2 

+ 1 

100 

±0.25 

0.0508 

C&B, D&E* 

• A/P driving 

Runs 1&2 take before retorquing 

3-5 

+ 1 

100 

±0.25 

0.0274 

C&B, D&E* 

• PACS servo 
grounded* 3 

Runs 3-5 taken after retorquing 
Reduction in hysteresis 

= (0.0508-0.0274)x100 _ 46Q6% 

0.0508 


TEST “B” TOTAL LINKAGE HYSTERESIS 


3-5 

+ 1 

100 

±0.25 a 

0.0274 

C&B, D&E* 

• A IP driving 

Average of total hysteresis 








0.0274 +0.0326 + 0.0398 + 0.0339 

I9&20 

+ 5 

105 

±0.25 

0.0326 

C&B, D&E* 

• PACS servo 

4 







grounded* 3 

= 0.0334-deg 8 E 

15-18 

+ 10 

93 

±0.25 

.0398 

C&B D&E* 


Feel unit disconnected to 

16&17 

+ 13 

94 

±0.25 

.0339 

C&B D&E* 

• Feel & cent. 

prevent A IP disengaging 







unit 

disconnected 




TEST “C” 

TEST ACT CONFIGURATION (PACS SERVO DRIVING) 

28-30 

+ 1.25 

100 

±0.25 a 

0.0680 

F&E* 

• PACS servo 

Represents Test ACT 







driving 

# A/P grounded 

configuration 



TEST “D” 

EFFECT OF CENTERING SPRING REMOVAL 


6&7 

+ 5 

100 

±0.25 

0.0410 

C&B, D&E* 

• A/P driving 

Runs 6&7 taken before spring 







• Feel unit 

removal 

8&9 

+ 5 

100 

*0.25 

0.0759 

C&B, D&E* 

disconnected 

Runs 8&9 taken after spring 




* PACS servo 

removal 







grounded* 3 

Increase in hysteresis due to 
spring removal = 85% 



TEST “E” 

EFFECT OF LOAD REVERSAL ON POGO SUPPORT BEARINGS 

19&20 

+ 5 

105 

±0.25 

0.0326 

C&B D&E* 

• A/P driving 

Contribution to linkage 
hysteresis of PCU bellcrank, 

19&20 

+ 5 

105 

±0.25 

0.0207 

C&A D&E* 

• Feel unit 
disconnected 

and pogo support bearings down- 
stream of centering springs. 

8 £ = +5 deg contribution 

15&18 

+ 10 

93 

± 0.25 

0.0398 

C&B D&E* 


= 100 x|T0326-.0207]= 36.50% 







• PACS 

L .0326 J 

15&18 

+ 10 

93 

±0.25 

0.0193 

C&A D&E* 

grounded* 3 

§ E = +10 deg contribution 



= 100 xF0398-. 01941= 51.51% 








L .0398 J 

16&17 

+ 13 

94 

±0.25 

0.0339 

C&B D&E* 


8 £ = +13 deg contribution 








= 100 xF0339-.0194l= 42.77% 

16&17 

+ 13 

94 

±0.25 

0.0194 

C&A D&E* 


L .0339 J 


a Feel unit connected c Comparison of results of test "B" ' Overall hysteresis measured on x-y plotter 

b PACS system grounded d See Figure B-1 
by existing springs 
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Table B-1. Hysteresis in 757 Elevator Control System (Continued) 


RUN NO. 

6 e 

(deg) 

PERIOD 

(sec/cycle) 

AMPLITUDE 
(deg 8 e ) 

HYSTERESIS 
AVERAGE OF 
RUNS (deg A ) 

HYSTERESIS 
MEASURED 
BETWEEN d 

SYSTEM 

CONFIGURATION 

COMMENTS 



TEST “F” 

TOTAL HYSTERESIS (A/P HYSTERESIS NOT INCLUDED) 

22&23 

+ 1 

100 

±0.25 

0.0945 

G&E* 

• A/P driving 

Runs taken to isolate surface 







• Feel unit 
disconnected 

PCU hysteresis from total 
At S E =+1 deg : .0945 deg -.0274 deg 
-- .0671 deg & E PCU hysteresis 

24&25 

+ 5 

100 

±0.25 

0.0810 

G&E* 

• PACS 
grounded 13 

At = + 5 deg : .0810 deg -.0326 deg 
c -- .048 deg S e PCU hysteresis 



TEST “G” 

OVERALL HYSTERESIS (A/P DRIVING) 


19&20 

+ 5 

105 

± 0.25 

0.0775 

D&E* 

• A/P driving 








• Feel unit 
disconnected 








• PACS 
grounded 13 




TEST “H” 

EFFECT OF PCU BIAS SPRINGS- PACS DRIVING 


31-34 

1.25 

97 

0.25 

0.0448 

F & E* 

• Elev PCU 
bias springs 
installed 

Same as Test "C" with the 
addition of bias springs. 







• PACS driving 

• Right A/P 
engaged 

Reduction in hysteresis 







• Feel unit 
connected 








• All hyd on 



TEST “I” EFFECT OF PCU BIAS SPRINGS - A/P DRIVING 


35-37 

5 

103 

±0.25 

0.0912 

D&E* 

• Elev PCU 
bias springs 
installed 

• Center A/P 
driving 

Same as Test "G" with the addition 
of bias springs. Test “1" increased 
hysteresis, under investigation. 

38-39 

1 

97 

±0.25 

0.1033 

D&E* 

• Feel unit 
disconnected 








• All hyd on 



a Feel unit connected c Comparison of results of Test “B" * Overall hysteresis measured on x-y plotter 

b PACS system grounded d See Figure B-1 
by existing springs 
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Test runs 6 through 9 were made to investigate the effects of removing the control 
system linkage centering springs while cycling the elevator +0.25 deg from 5 deg down. 
Runs 6 and 7 recorded hysteresis data before spring removal, and runs 8 and 9 recorded 
data after spring removal. They are grouped as "TEST D" in Table B-l. , 

In test runs 10 through 14, mechanical dial gages were used to measure the movement of 
the intermediate linkages from the aft quadrant to the inboard bellcrank. This would 
allow the hysteresis contribution of the elevator PCUs to be determined from the overall 
hysteresis measurements. Runs 10 and 11 recorded data cycling the elevator at +0.25 deg 
from 5 deg down, while runs 12 through 14 recorded data at +0.25 deg from 1-deg down 
elevator. 

Test runs 15 through 20 were made to measure the effects of increasing linkage load on 
hysteresis and were accomplished by disconnecting the feel and centering unit from the 
aft quadrant and cycling the linkage +0.25 deg at increasing elevator down angles. Runs 
15 and 18 were taken at 5-deg down elevator, runs 16 and 17 at 10-deg down elevator, and 
runs 19 and 20 at 13-deg down elevator (the pitch autopilot authority limit). These runs 
also utilized dial gages at the middle PCU input lever and the inboard bellcrank to 
supplement the data of runs 10 through 14. These tests are grouped together and labeled 
as "TEST E" and are then combined with runs 3 through 5 as "TEST B" in Table B-l. Run 
21 was intentionally deleted. 

Runs 22 through 25 were conducted to determine the hysteresis contribution of the driving 
pitch autopilot servo. This was accomplished by plotting elevator trailing-edge angle 
against autopilot servo output voltage instead of input voltage previously monitored. 
Comparison of data from these runs with data from runs 12 through 14 at 1-deg down 
elevator and runs 15 and 18 at 5-deg down elevator resulted in the autopilot servo internal 
hysteresis. These tests are grouped and labeled as "TEST F" in Table B-l. Runs 26 and 27 
were intentionally deleted. 

Runs 28 through 30 were made to gather hysteresis data while driving the control system 
linkage at a point nearest that of the Test ACT System. By driving the linkage with the 
Pitch Augmentation Control System (PACS) servoactuator, a portion of the linkage not 
common to the Test ACT System could be eliminated. Since the PACS servo travel is 
limited by mechanical stops internally, the cycling had to be performed at +0.25 deg from 
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1.25-deg down elevator. The difference between this point and the 1-deg down point of 
previous tests is negligible. These tests are grouped and labeled as "TEST B" in Table B-l. 

Test runs 31 through 34 were made to measure the effect of a PCU bias spring on the 
elevator hysteresis. The runs were made with the PACS driving the system +0.25 deg 
from 1.25-deg down elevator. These runs are grouped and labeled as "TEST H." 

Test runs 35 through 39 were also made to measure the effect of a PCU bias spring on 
elevator hysteresis. The runs were made with the autopilot servo driving the system. 
Runs 35 through 37 drove the elevator +0.25 deg at 5 deg down. Runs 38 through 39 drove 
the elevator +0.25 deg at 1 deg down. These runs are grouped and labeled as "TEST 1." 

B.3 SUMMARY OF RESULTS 

Satisfactory performance of the fly-by-wire system projected for the 757 elevator control 
(Test ACT Program) depends largely on the level of hysteresis in the mechanical path 
between the electric command servos and the input to the surface PCUs. 

An analysis that considered the contributions of the Test ACT servos, the surface PCUs, 
and the intermediate linkage resulted in a calculated hysteresis of 0.15-deg surface angle 
(5j:). In order to verify this value experimentally, measurements of hysteresis in the 
control path between the pitch autopilot servos and the elevator surface were taken from 
the 757 FCTR elevator control system. In addition, measurements were taken between 
the PACS, an experimental series pitch augmentation servo, and the elevator surface. It 
should be noted that the analysis included the effects of low temperature on bearing 
friction, as well as the additional linkages of the Test ACT System, while the values of 
hysteresis measured on the FCTR were exclusive of these elements. 

The following measurements were recorded at approximately 0.01-deg 6^ per second: 

• Overall (PACS input voltage versus surface rotation) hysteresis measured was 0.07- 
deg 5 £ . 

© Overall (PACS input voltage versus surface rotation) hysteresis measured, with PCU 
bias springs, was 0.045- deg 5^. 
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Total intermediate linkage hysteresis measured was 0.03-deg 5^. 


• Excluding local PCU input links, intermediate linkage hysteresis measured was 0.02- 
deg 5 e . 

• Across PCUs, hysteresis measured was 0.04-deg 8^. 

• Retorquing of linkage bolts reduced hysteresis from 0.0508- to 0.0274-deg 8^ (46%). 

B.4 DISCUSSION AND CONCLUSIONS 

Two methods were used to measure hysteresis in the elevator control system. One plotted 
overall hysteresis loops on a plotter using a string potentiometer to measure surface 
position versus autopilot or PACS servo input voltage. The other method took dial 
indicator measurements of travel at points along the linkage (fig. B-l). Measurements 
using both methods were taken simultaneously. To assess the effects of load increase in 
the linkage on hysteresis, plots were taken at about four different elevator trim angles (1, 
5, 10, and 13 deg) while cycling the surface at +0.25-deg 8^ at a period of 100 sec/cycle— 
the maximum rate that allowed reading of the dial gages. Changes in elevator angles 
were accomplished by applying sinusoidal and offset voltages to the center hydraulic 
system autopilot servo. The results of these runs, shown in Figure B-2, illustrate that the 
linkage hysteresis is not extremely sensitive to load increases. 

To determine the effect on hysteresis of insufficient tightness of linkage joint bolts, two 
runs were made— one before and one after tightening all bolts in the linkage. A reduction 
in hysteresis of 46% was measured on the run subsequent to tightening (table B-l, runs 1 
through 5, "TEST A"). The PCU pogo rod end bearings, because they are located 
downstream of the centering springs, will be subjected to load reversals and will therefore 
contribute a significant amount of hysteresis and backlash to the linkage system. Runs 15 
through 20, "TEST E," showed a contribution of 36.5% and 51.5% to the total linkage 
hysteresis. 

Most tests, as noted herein, were run using the parallel autopilot servo to cycle the 
elevator. To better represent the Test ACT Configuration, hysteresis loops were also 
plotted using the series PACS servo input. Loops were plotted using inputs from the 
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Linkage Hysteresis, deg 8 




PACS servo input voltage versus elevator trailing-edge string potentiometer output 
voltage, "TEST C." These measurements were taken with one autopilot engaged in order 
to increase the stiffness-to-ground of the aft quadrant. The hysteresis measured in this 
case was 0.07-deg 8^ and is shown in Figure B-3. 

The elevator PCUs were modified by installing a 2.2-N (0.5-lb) servovalve bias spring. 
The conditions of "TEST C" were repeated with the modified PCUs. This was labeled as 
"TEST H." Under these conditions the average hysteresis was reduced to 0.045-deg 8^ 
and is shown in Figure B-4. 

Runs 6 through 9 were made to determine the effect of removing the centering springs on 
the linkage hysteresis and backlash (fig. B-l). Linkage measurements were taken at the 
aft quadrant and the input point on the middle surface PCU. Removal of the springs 
caused an increase of 85% in hysteresis and backlash in the linkage, "TEST D." 

To obtain a hysteresis value for the surface PCU and its support bearings, additional runs 
were made in which autopilot hysteresis was not included. Autopilot output linear 
variable differential transformer (LVDT) voltage was used to plot hysteresis loops rather 
than autopilot input voltage. PCU hysteresis was obtained by subtracting the total 
linkage hysteresis. This was found to be between 0.048- and 0.067-deg &£, "TEST F." 

These measurements may be compared with those of a similar test performed on the 767 
FCTR elevator in November 1982. Those results showed an overall hysteresis (from PACS 
input to elevator output angle) of about 0.05-deg 8^, with the linkage contributing 0.03- 
deg S£ and the PCUs showing 0.02-deg 8^. The results from this system, which include 
PCU valve bias springs, compare closely with those of the 757 system with bias springs 
added, "TEST H." 


B.5 RECOMMENDATIONS 

The foregoing results indicate that the existing surface PCUs should be fitted with 
servovalve bias springs to reduce the freeplay existing between the servovalve and linkage 
downstream of the centering springs when used in the Test ACT airplane. The elevator 
linkage joints must be maintained to proper torques throughout the flight test program. 
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PACS Input Voltage 

Figure B-3. Hysteresis~PACS to Elevator Surface 
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Figure B-4. Hysteresis-PACS With PCU Bias Springs to Elevator Surface 
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APPENDIX C 

STRUCTURAL CONSIDERATIONS 


C.l GENERAL 

Preliminary structural design loads and flutter analyses have been conducted for the 757 
Test ACT aircraft to assess the airframe structural capability during flight testing. These 
analyses have considered the proposed Test ACT flight test envelope, as well as variations 
in gross weight and center of gravity (eg) provided by the ballast system. The results of 
these studies consist of preliminary recommended operating limitations and placards, 
ensuring that the structural capability of the 757 airframe will not be exceeded. 

C.2 STRUCTURAL OPERATING LIMITATIONS 

Preliminary structural operating limitations are presented in the following: 

Takeoff and Landing 

• Maintain center of gravity within certificated limits 

• Limit sink rate at touchdown to 1.8 m/sec (6 ft/sec) 

Flight-Flaps Up 

• Limit maneuver load factors to: 

• +2.0g 

• °g 

• Do not operate in greater than moderate turbulence 

Flight-Flaps Down 

• Limit maneuver load factors to: 



C.3 STRUCTURAL LOADS ANALYSES 


To accomplish the objectives of the flight demonstration program, it will be necessary to 
conduct flying quality tests at centers of gravity aft of certificated structural design 
limits. An aft eg envelope that can be achieved in flight has been established using the 
planned 757 flight test water ballast system, supplemented with 23-kg (50-lb) sand bags 
piled in the aisles and around seats in the aft end of the airplane and the aft lower lobe. 
For taxi, takeoff, and landing, the eg is maintained within design limits by storing all 
water ballast in water barrels on the forebody main deck and in the forward lower lobe. 
After takeoff, the desired aft eg is obtained by pumping water aft into barrels on the aft- 
body main deck and in the aft lower lobe. 

This arrangement requires appropriate flight placards to ensure that flight test loads 
remain within existing structural design loads for the horizontal tail, aft-body monocoque, 
and aft-body floor beams. Landing sink speed limitation may be required if design load 
limits are not to be exceeded during landing operations. 

Time history simulations were performed on the 757 engineering flight simulator to 
substantiate the static maneuver envelope for aft eg positive check maneuvers, which are 
the horizontal tail maximum up-load cases. The pitch-augmented stability (PAS) control 
laws were included to provide airplane and tail load dynamic response due to combined 
pilot and PAS commands. Figures C-l and C-2 show selected time history results for one 
of the critical positive check maneuvers. Results are shown for both the Primary PAS 
control law and the Essential PAS control law for the same column command. The action 
of PAS on elevator deflection and airplane response is evident in these figures. 

Figures C-3 and C-4 show body load envelopes for symmetric high-speed maneuvers and 
indicate the effect of the recommended flight limitations. 

These analyses of structural design loads will be updated prior to flight test in order to 
reflect the final Test ACT System Configuration and test requirements. Included will be 
consideration of balanced flight maneuver, pitch and yaw maneuver, gust, landing, and 
assumed control system dynamic failure conditions for the final flight test envelope. 
Critical combinations of speed, altitude, and loading configurations will be analyzed. 
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Figure C-1. Positive Check Maneuver at Dive Speed 
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Alt = 7300m (24 000 ft), M = 0.91, V E = 193 m/sec (375 kn) equivalent airspeed 
GW = 98 400 kg (217 000 lb), l yy = 9.9 kg-m 2 (7.3 x 10 6 slug ft 2 ) 
eg = 55% MAC 5 
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Figure C-2. Tail Load Time Histories for Positive Check Maneuver at Dive Speed 


Balanced and pitch maneuvers and gust conditions will include the effects of the Primary 
plus the Essential system, as well as the Essential system alone, for the range of flight 
conditions and' eg locations that will be flight tested. Loads analyses of critical 
oscillatory and hardover Test ACT System failure conditions will use beam theory to 
represent the structural flexibility of the test airplane. Lifting line aerodynamic theory, 
with empirical corrections derived from wind tunnel and flight tests, will be utilized. 

Final test limitations and placards based upon these loads analyses will ensure the 
structural integrity of the test airplane while minimizing structural changes. 
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Ultimate Vertical Shear, 
10 3 N (10 3 lb) 


Front Rear 
Spar Spar 



Safety Factor = 1.5 for FAR conditions 

Vertical maneuver load factor limited between 0 and 2 on Test ACT demonstration 


Figure C-3. Fuselage Vertical Shear Envelope for Flight Conditions 
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APPENDIX D 

MECHANICAL CONTROL SYSTEM MODIFICATIONS 


This appendix presents an expansion of the material in Section 8.1.3. It is a more detailed 
description of the mechanical changes to the flight deck under-floor and empennage areas 
of the test airplane. 


D.l FLIGHT DECK INSTALLATIONS 

The current 757 control column and tension regulator installation is shown in 
Figure D.l-1. A cam and follower breakout unit limits torque that can be transmitted 
between columns in the column bus tube. Separated bearings in the bus tube overlap allow 
independent rotation and provide bending continuity across the joint. The tension 
regulator quadrants are driven by motion imparted to symmetrical cranks by rods from 
each control column; rotations of the two quadrants are in opposite directions. 

Test ACT flight deck installations are shown in Figure D-2. Removal of the follower and 
springs from the bus tube override allows the two columns to rotate independently on the 
tube splice bearings, described previously. The first officer's column is disconnected from 
the right tension regulator by removing the input rod, and the right and left tension 
regulators are connected with a diagonal bus to preserve the stiffness of two cable loops 
for elevator inputs from the captain's column (fig. D-3, 3 sheets). 

The Test ACT pilot input mechanism, supported on truss-like brackets attached to flight 
deck beams aft of the first officer's column, consists of a torque tube, mounted parallel to 
the column bus tube, to which the feel cam and input force transducers are attached. The 
column is connected to the unit through a rod fastened between the existing column crank 
clevis and a crank pivoted on the input mechanism torque tube. The load path from this 
crank to the feel cam is divided to pass through two four-channel force transducers such 
that the sum of the signals in a single channel from each transducer is approximately 
proportional to the column load. 
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Figure D-3. Forward Bus Installation (Drawing: ACT-LO-FCDIOO)- 
Sheet 1 of 3 
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Figure D-3. Forward Bus Installation (Drawing: ACT-LO-FCDIOO)- 
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a 

a 
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D 

1 

i 
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ACT-LO-FCD 100-1 




1 

i 

■ 

_ 

i 

-2 

ROD ASSY 


P2, P3 

■ 

i 

■ 

i 


-3 

ROD 

1.00 X 1.50 X 41.00 


r 

i 

i 



-4 

CRANK 

3.00 X 3.00 X 11.00 

Ml, FI, PI, P4, P5 

■ 

i 

■ 


i 

-5 

CRANK ASSY 



■ 

i 

■ 


i 

-6 

CRANK ASSY 




i 

■ 



251N201 3-1 

TENSION REGULATOR 
INSTL. 



L 

i 




251N2013-2 




■ 

i 

■ 

i 


BACBI0AE-9B 

ROD END 



■ 

i 

i 

i 


BACB10AD-5K 

ROD END 



L 





BACB30NF-37 

BOLT 



■ 

i 

■ 


2 

BACB30NF-14 

BOLT 




1 “TV 

PART NO. 

DESCRIPTION 

STOCK SIZE 

NOTES 

r 


B 

a 

D 



2 

2 

2 

BACN103C4 






2 

2 

2 

AN960PD416 





Ml: 15-5PH STAINLESS STEEL BAR PER AMS5659. HEAT TREAT TO ISO - 200 KSI 
PER BAC-5619. 

PI: MAGNETIC PARTICLE INSPECT PER BAC5424. 

P2: COAT FAYING SURFACES WITH WET BMS 5-95, SEALANT PER BAC-5000. 

P3: INSTALL FASTENERS WITH F-20.06. 

P4: MARK PARTS PER BAC5307. 

P5: PENETRANT INSPECT PER BAC5423. 

FI: F-16.01. 


Figure D-3. Forward Bus Installation (Drawing: ACT-LO-FCD100)-Sheet 3 of 3 
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The force-displacement program of the feel cam, follower, and springs arrangement was 
designed to meet the requirements of Figure D-4. The degree of proportionality of the 
transducer input force is shown in Figure D-5. The signal is virtually linear for about two- 
thirds of the column travel and falls off at the travel limits due to linkage geometry 
effects. System gains are such that all elevator requirements for Test ACT, including full 
travel ground demonstrations, are achievable within the linear range of transducer output 
signal. 

An adjustable hydraulic rotary rate damper is attached to the torque tube system through 
a crank and link. The damping force is adjustable in the range of 113 to 226 N-m per 
rad/sec (1000 to 2000 in.-lb per rad/sec). This amounts to 1.8 to 2.6 N/cm (1 to 2 
lb/in. /sec) at the wheel. 



Figure D-4. Control Column Feel System Requirements 
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Figure D-5. Force Transducer Characteristics 

Column inertial forces pass through the force transducers so column unbalance is a 
concern. Each column weighs approximately 14 kg (30 lb), with a eg of about 0.25m 
(10 in.) above the pivot. Balance weight of about 8.6 kg (19 lb) was added on a special 
support assembly, available from 7 57 flight testing, to bring the first officer's column 
unbalance to approximately zero. The left column was also balanced in this way to 
preclude any inputs or reduction of summing lever detents due to attitudes or 
accelerations during fly-by-wire (FBW) flight modes. Flight deck installation details are 
shown in Figure D-6 (9 sheets). 
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Figure D-6. Transducer and Feel Installation (Drawing: ACT-LO-FCD103)-Sheet 1 of 9 
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-4 

-3 

-2 

-! 








ACT-LO-FCD 103-1 

ACT TRANSDUCER 
& FEEL INSTL 









1 

-2 

ACT TRANSDUCER 
& FEEL ASSY 







. 

j 


-3 

TRUSS ASSY - 
INBD 






_ 


1 


-4 

TRUSS ASSY - 
OUTBD 







1 



-5 

RECT. TUBE 

BAC1501 -1145 
.625 X 1.5 X 10.0 

F2, Ml 





I 



-6 

RECT. TUBE 

BAC1501 -1145 
.625 X 1.5 X 17.0 

F2, Ml 




1 




-7 

RECT. TUBE 

BAC1501 -100033 
1.00 X 1.50 X 12.00 

F2, Ml 




1 




-8 

RECT. TUBE 

BAC1501 -100033 
1.00 X 1.50 X 17.00 

F2, Ml 




1 




-9 

PLATE 

10.00 X 16.00 X 3.00 

FI, M8, PI 


1 “IV 

PART NO. 

DESCRIPTION 

STOCK SIZE 

NOTES 



-20 

-17 

-4 

-3 

-2 





1 



-10 

PLATE 

10.00 X 16.00 X 3.00 

F1.M8. PI 






1 


-11 

SPACER PLATE 

6.00 X 12.00 X .625 

FI. MX. PI. 





1 



-12 

SPACER PLATE 

6.00 X 9.00 X 1.00 

F1.M8, PI 





1 



-13 

SPACER PLATE 

6.00 X 7.00 X 1.00 

FI, MS, PI 







1 

-14 

SUPPORT 

8.00 X 28.00 X .071 

FI, M2 







1 

-15 

SUPPORT 

6.00 X 7.00 X .071 

FI, M3 







1 

-16 

SUPPORT 

6.00 X 7.00 X .071 

FI, M3 




_ 




-17 

INPUT CRANK ASSY 






1 




-18 

INPUT CRANK 

5.00 X 12.00 X 4.00 

FI, M6, PI 







1 

-19 

WIRE SUPPORT 
BRACKET 

8.00 X 9.00 X .071 

FI, M3 



_ 




1 

-20 

FEEL CAM ASSY 





1 





-21 

FEEL CAM 

3.00 X 4.00 X 8.00 

F7, M9, P2 
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1 

■ 

■ 

■ 

i 


-22 

LOAD CRANK 




■ 

1 

■ 

■ 

i 


-23 

CRANK ASSY 




1 

1 

■ 

i 

■ 


-24 

CRANK 

3.00 X 8.00 X 2.75 

FI, M6 


1 

■ 

■ 

■ 

H 


-25 

HOOK SUPPORT ASSY 






i 




-26 

HOOK SUPPORT 

2.50 DIA. X 1.50 

FI, M7 


1 




2 


-27 

EYE BOLT 

1.75 X 1.75 X6.00 

F5, M9, P2 


i 




■ 

■ 

-28 

FOLLOWER ARM 
ASSY 








■ 

■ 

-29 

FOLLOWER ARM 

3.00 X 12.00 X 4.00 

F7, M9, P2 






1 


-30 

SHAFT 

2.000 D X .08 WALL 
X 22.00 

F2, Ml 






2 


-31 

SPRING 


F6, M10 






■ 

■ 

-32 

CRANK 

3.00 X 8.00 X 1.00 

F3, M6, PI 







i 

-33 

FILLER 

1.50 X 1.50 X .625 

FI, M8 


| QTY 

PORT NO. 





H 

m 

m 

S3 

B 

a 








-34 

FILLER 

1.5 X 1.5 X .625 

Fl, M8 


■ 

■ 

■ 

■ 

■ 

i 

-35 

ROD ASSY 




■ 


i 

■ 

■ 

■ 

-36 

ROD 

.75 DIA. X 16.00 

FI, M4 


■ 

■ 

■ 

■ 

■ 

2 

-37 

COLUMN BALANCE 
ASSY 





10 

■ 

■ 

1 

■ 

-38 

COL. BALANCE WT. 

6.0 X 6.0 X .30 

F5, M9 






7 


-39 

XDCR BALANCE WT. 

3.0 X 4.0 X .30 

F5, M9 


■ 

■ 

■ 

■ 

■ 

■ 

-40 

ANGLE 

AND 101 34- 1406 
1.25 X 1.50 X 3.50 

Fl, M5 






I 


-41 

FILLER 

BAC1511-3701 
1.28 X .125 X 2.00 

F1,M5, PI 


2 

■ 



■ 

■ 

-42 

PLATE 

9.0 X 13.0 X .25 

Fl, M8 


1 

■ 



■ 

, 

-43 

SPACER PLATE 

3.0 X 6.0 X .125 

■ 



■ 


1 


■ 
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BACR26N653 


5MN 5037-1 


-2 

COL. BALANCE INSTL 

GM7197 

TRANSDUCER 

P/NA- 16928-1 

HYD. DAMPER 

6NBF817Y3TT 

TRACK ROLLER 

BACB10AC6 

BEARING 

BACB20AC6A 

BEARING 

BACB10AC6 

BEARING 

NAS72-6E102 

BUSHING 

NAS77-9-48 

BUSHING 

BACB2SAK03-04S 

BUSHING 


PART NO. 

DESCRIPTION 

BACB2SAK04-032 


BACB28AK0L-037 

BUSHING 

BACB28AK06-030 

BUSHING 

BACB28AK04-2U 

BUSHING 

BACN10JC3 

NUT 

BACN103C9 

NUT 

BACN103C6 

NUT 

BACN 10JC10 

NUT 

BACB10AD-8 

ROD END 

BACB10AD-5 

ROD END 

AN316-10 

NUT 

AN316-6 

NUT 1 
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Figure D-6. Transducer and Feel Installation (Drawing: ACT-L0-FCD103)-Sheet 8 of 9 


D.23 












































































ACT-LO-FCD103 Part List and Notes 


1 «?Y 

PART NO. 

DESCRIPTION 

STOCK SIZE 

NOTES 




-4 

-3 

-2 

-1 






2 


BACB30NF4-4 

BOLT 









I 

BACB30LL4-16 

BOLT 










AN960PD416 

WASHER 










AN960PD416L 

WASHER 










AN960PD616 

WASHER 










AN960PD616L 

WASHER 










AN960PDI016 

WASHER 










BACC30M5 

COLLAR 










BACC30M6 

COLLAR 










BACC30M8 

COLLAR 















Ml: 2024-T3 AL. ALLOY TUBE PER BMS 7-196 

M2: 2024-T3 AL. ALLOY SHEET PER QQ-A-250/4 

M3: 2029-0 AL. ALLOY SHEET PER QQ-A-250/4. 

HEAT TREAT TO T42 PER BAC5602. 

M4: 2024-T42 AL. ALLOY ROD PER QQ-A-225/6 

M5: 2024-T3511 AL. ALLOY EXTRUSION PER QQ-A-200/3. 

M6: 7073-T7351 AL. ALLOY PLATE PER QQ-A-250/12. 

ULTRASONIC INSPECT PER BAC5439, CLASS B. 

M7: 7075-T7351 AL. ALLOY ROD PER QQ-A-225/9. 

MS: 2024-T351 AL. ALLOY PLATE PER QQ-A-250/4. 

ULTRASONIC INSPECT PER BAC5439, CLASS B. 

M9: 13-5 PH, BAR PER BMS7-240 TYP I, HEAT 

TREAT TO ISO- 200 KSI PER BAC5619. 

M10: 17-7 PH PER MIL-S-25043 HEAT TREAT TO ISO-200 KSI. 

PI: PENETRANT INSPECT PER BAC-5423, CLASS B. 

P2: MAGNETIC PARTICLE INSPECT PER BAC5424. 

P3: INSTALL BEARING PER BAC-5435. 

P4: INSTALL BUSHING PER BAC-5435. 

P5: ROLLER SWAGE PER BAC-5435. 


P6: FILL WITH EPOXY RESIN PER BAC-5432 

COMPOUND NO.S OR NARMCO 31 19 AND CURING 
AGENT 7103 PER NARMCO DATA SHEET SRDS II. 

P7: COAT FAYING SURFACES WITH WET BMS 5-95 

SEALANT PER BAC-5000. 

PS: INSTALL FASTENERS WITH F-20.06. 

FI: F-17.04 + F-20.02 

F2: F-1S.07 

F3: F-17.04 + F-20.03 

F4: F-16.03 

F5: F-20.02 

F6: F-16.03 

F7: F- 16.01 

VC1: KAVL1CO CORPORATION 
CHATSWORTH, CA. 91311 

VC2: HYDRAULICS HOUDAILLE INC. (SEE ATTACHMENT) 
BUFFALO, NY. 14211 

VC3: TORRINGTON 

TORRINGTON, CONN. 


Figure D-6. Transducer and Feei Installation (Drawing: ACT-LO-FCD103)-Sheet 9 of 9 


D.24 



D.2 EMPENNAGE INSTALLATION 


Figure D-7 shows the unmodified 757 test airplane elevator linkage arrangement. Dual 
cable quadrants are linked to a dual feel unit, which in turn is grounded through an 
override and cam to the stabilizer. Stabilizer motions provide a programmed elevator 
input to augment nose-down trim effectiveness. Triple autopilot servos also attach to the 
cable quadrants, and right and left output linkages transmit quadrant motions through a 
summing mechanism near the side of the body to elevator surface actuator linkages on the 
stabilizer spar. Triple-parallel hydraulic surface actuators are positioned by conventional 
mechanical closed-loop controls. These actuators are the balanced, moving piston type. 
A body-mounted valve is positioned by a summing lever attached to the piston for 
feedback and, through a collapsible link (pogo), to a spar-mounted bellcrank for input. 
The three bellcranks are linked together in parallel and driven by a pushrod system from 
the aft quadrant. 


Stabilizer 



Figure D-7. 757 Empennage Installations-Linkage Schematic 
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Centering springs are fitted between the bellcrank and ground at the two outboard 
actuator positions. These springs maintain the elevator in a near-faired position in the 
event of a disconnect of an inboard component. 

The input pogo links are provided to protect against a jammed valve. In such a case, the 
pogo associated with the offending valve collapses with an additional column load of about 
53N {12 lb). This allows the two healthy actuators to bring full load to bear on the 
immobilized one, which bypasses at its relief valve setting of about 24.1 x 10 Pa (3500 
lb/in.^). Normal single system pressure is 19.3 x 10^ to 20.7 x 10^ Pa (2800 to 3000 
lb/in. ). Thus, continued surface control is available with reduced hinge moment 

capability. In the event of a frozen or corroded pogo, the pilot can bypass a jammed valve 
by shearing out the special fused joint in the associated bellcrank with a one-time load of 
about 178N (40 lb) at the column. 

The Pitch Augmentation Control System (PACS) summing mechanisms near the side of 
body were established early in the 757 design to meet an anticipated need for 
augmentation during stall approaches. Flight testing proved the augmentation 
unnecessary, but the mechanisms remain deactivated in early airplanes, including the test 
airplane. These sites are used to mount a similar summing mechanism for introduction of 
the Test ACT FBW servo mechanical commands into the elevator actuator input linkage. 

The pitch feel unit features decentering springs that neutralize the effect on pilot feel 
schedules of the two centering springs in each elevator surface linkage. This arrangement 
is retained in the Test ACT Configuration to ensure the same feel characteristics during 
mechanical-mode flight. 

The Test ACT empennage linkage arrangement is shown in Figure D-8. Changes to the 
757 cable system input and surface actuator installations are: 

O Reduction from three to one modified autopilot servo 
® Grounding of the neutral shift input 

o Addition of a solid bus link between right and left quadrants 
• Addition of small bias springs (not shown) in the surface actuator valves 
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Figure D-8. Test ACT Empennage Installations-Linkage Schematic 

( 

Fly-by-wire and augmentation inputs are provided by four added Test ACT servos, force 
summed on a single shaft to which a centering mechanism is attached in order to provide 
a fifth force vote. Servo shaft motions are delivered by pushrods to a right and left Test 
ACT summing mechanism where electrical and mechanical commands to the elevator 
actuators are combined. The summing link ratio has been chosen to preserve the full 
elevator authority of the mechanical control system while allowing nearly full authority in 
the Test ACT flight mode. Figure D-9 illustrates the electric control input-output 
characteristics of the summing mechanism for two ratios. The chosen ratio provides a 
reasonably linear and symmetrical elevator output close to the desired travels of +20 deg, 
-30 deg. 

In the Test ACT summing mechanism the summing lever, combined with a parallel motion 
idler crank, has the same length and airplane location as the equivalent member on the 
current PACS summing mechanism. Thus, with the Test ACT servos in the detent (Test 
ACT "off") position, the summing mechanism reproduces current 757 gearing between the 
aft quadrant and the elevator actuator input linkage. 
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A major requirement in the design of the Test ACT servo linkage was the assured 
availability of adequate elevator control in either input mode and under both normal and 
failure conditions. The important parameter in this regard is the detent level of the 
reactive end of the summing lever. This defines what load can be transmitted to the 
elevator surface linkage by one control mode before the summing lever begins to 
"back out" against the detent provided by the other control system. Also of interest is the 
authority remaining when the surface load exceeds the detent setting and when a 
complete disconnect of the summing lever has taken place. 

After consideration of several multichannel active locking designs, a passive summing 
lever spring arrangement was chosen that effectively neutralizes the normal operating 
surface input load encountered during the Test ACT inputs. When the mechanical mode is 
in use, the spring imparts no load since its line of action is maintained along the summing 
lever centerline. A functional model of the mechanism is shown in Figure D-10. 
Figure D-ll shows the reactive load for zero backout required by electric-mode control 
for various operational conditions, including a jammed surface valve in which the valve 
input pogo is compressed. The loads are shown in terms of an equivalent control column 
reaction force. Also illustrated is the neutralizing effect of the summing lever springs. 

The detent levels available for reaction of Test ACT operational loads are shown in 
Figure D-12 superimposed on the load curves of Figure D-ll. The total reaction is made 
up of two load components: that from the feel unit and system friction, totaling about 
22N (5 lb), and that from the specially modified autopilot servo, about 58N (13 lb), 
expressed as equivalent column force. The combined 80-N (18-lb) detent will cover 
normal and valve-jammed Test ACT control requirements, as shown. 

Autopilot servo modifications that provide a detent function are described later in this 
section. The function is activated through switching procedures during initiation of the 
Test ACT flight mode. 

Since the autopilot detent control is single channel, the feel unit, which is a dual 
hydromechanical device, must provide a reaction level sufficient for normal Test ACT 
operation during the period of time following an autopilot servo disconnect. As shown in 
Figure D-13, a small backout occurs in the nose-down direction with autopilot servo loss; 
however, elevator travels are sufficient for any requirement encountered in Test ACT 
flight. 
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To Elevator 



Figure D-10. Test ACT Summing Mechanism-Functional Model 
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/ | Summing level backup loads 

Normal operating 

maximum surface rate 

— — — Normal operating 

minimum surface rate 

Valve pogo 

(maximum surface rate) 

Available reactions: 

Feel unit alone 

With autopilot 
detent 


Figure D-12. Summing Lever Reaction-Electric Control 



Backout Angle 



Figure D-13. Electric Control Authority-Effect of Autopilot Detent 


Because of the neutralizing effect of the summing lever spring, very little elevator 
authority is lost following a complete disconnect of one summing mechanism from the 
cable quadrant. As shown in Figure D-14, the affected elevator is shifted a small amount 
in the nose-up direction. The null transient would be equivalent to a step input of about 
0.5 deg of elevator deflection (S^). Of course, mechanical-mode control authority would 
be reduced by half after such a break. 
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To 

Right 

Elevator 


Figure D-15 shows the operational load reactions when pitch control is in the mechanical 
(Test ACT "off") mode. In addition to normal operating and valve pogo loads, the 
requirement for a bellcrank shearout is shown. Because of its low probability of 
occurrence, shearout capability is a strict requirement only in the mechanical control 
mode. At all except very low speeds, the electric control mode is capable of effecting a 
shearout. 
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( Reaction at 

Servo Shaft, 
N-m (in.-lb) 



Figure D-15. Summing Lever Loads-Mechanical Control 


(. 
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The reaction requirements shown in Figure D-i5 are given in terms of equivalent torques 
at the Test ACT servo shaft. Again, as in the electric control mode, the summing lever 
springs produce a significant reduction in reaction loads, illustrated by the curves of loads 
with springs omitted. 

Loads for normal operation and valve pogo compression during mechanical control are 
reacted by the servo centering unit detent (also called the "voting detent"). To meet the 
force voting requirement, this detent should be about 17 N-m (150 in. -lb), nose up and 
nose down. This value is satisfactory for reaction of nose-up loads; however, nose-down 
load reaction must be about 28 N-m (250 in.-lb). Accordingly, an asymmetrical detent has 
been incorporated in the servo centering unit torque program (fig. D-16). 



Figure D-16. Servo Centering Unit Torque 


) 
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As shown in Figure D-17, the voting detent covers all normal and valve pogo loads with 
zero backout. The out-of-detent gradient, provided by the summing lever spring and servo 
centering unit torques, reacts shearout loads with a backout of less than 50% servo travel. 
Once a shearout is effected, the system returns to center, and the control loads return to 
the normal range. 

Reaction at Servo Shaft, 
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Figure D-18 shows the effect of a servo rod disconnect on mechanical control. The result 
is a net elevator authority of approximately 80%, following a null shift equivalent of 
about 1.0-deg 5^. 


Actual Elevator, deg 



8-deg Asymmetry 


Mechanical Command, deg 
(Elevator deg) 


'Elevator Control 
After Disconnect: 

-Disconnected Side 
-Normal Side 


8-deg Asymmetry 



To 

Left £TT7. • 
Elevator , 


Disconnect - 



Figure D-18. Mechanical Control Authority 







Figure D-19 shows Test ACT servo torque requirements for normal control. All elevator 
travel requirements, including ground demonstration of full travei, are within the 
combined minimum torque capability of two servos. Single servos would cam out at 
somewhat greater than half travel. However, operation is applicable only to single-servo 
ground tests, which will require travels of less than +5-deg 5^. See Figures D-20 (10 
sheets) and D-21 (16 sheets) for empennage installation details. 



Figure D-19. lest ACT Servo Torque Requirements 
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Figure 0-20. Test ACT Servo Installation (Drawing: ACT-LO-FCD101)- 
Sheet 1 of 10 
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Figure D-20. Test ACT Servo Installation (Drawing: ACT-L0-FCD101)-Sheet 2 of 10 
















Figure D-20. Test ACT Servo Installation (Drawing: ACT-LO-FCDIOI)- 
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Figure D-20. Test ACT Servo Installation (Drawing: ACT-LO-FCDIOI)- 
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Figure D-20. Test ACT Servo Installation (Drawing: ACT-LO-FCDIOI)- 
Sheet4of10 


D.47 & D.48 







Figure D-20. Test ACT Servo Installation (Drawing: ACT-LO-FCDIOI)- 
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Figure D-20. Test ACT Servo Installation (Drawing: ACT-LO-FCDIOI)- 
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Notes for ACT-LO-FCD 101 Parts List 


Ml 7075-T7351 BAR PER QQ-A-225/9. ULTRASONIC INSPECT PER 

BAC 5l»39 CLASS B. 

M2 15-5 PH BAR PER AMS5659. HT TR 180-200 KSI PER BAC5619. 

M3 2024-T42 EXTRUSION PER QQ-A-200/3 

M4 17-7 PH WIRE PER AM55678. HT TR TO CONDITION CH900 PER 

BAC5619. 

M5 7075-0 BARE SHT PER QQ-A-250/I2. HT TR TO T6 PER BAC5602. 

M6 2024-0 TUBE PER WW-T-700/7. HT TR TO T42 PER BAC5602. 

M7 2024-T42 CLAD SHT PER QQ-A-250/5. 

Pt PENETRANT INSPECT PER BAC5423 AFTER MACHINING. 

P2 MAGNETIC PARTICLE INSPECT PER BAC5424. 

P3 INSTALL PER BAC5435. 

P4 ROLLER SWAGE PER BAC5435. 

P5 FILL CAP IN SLEEVE WITH DOW-CORNING Q3-0I21 SEALANT PER 

BAC5000 AFTER SWAGING. 

FI F-18.13 

F2 F- 17.09 

F3 F- 18.07 

F4 F- 1 8.06 

F5 F-16.0I 


Figure D-20. Test ACT Servo Installation (Drawing: ACT-LO-FCD101)-Sheet 10 of 10 









































Figure D-21. Summing Mechanism Installation (Drawing: ACT-LO-FCD102)- 
Sheetl of 16 



-57 - 


— 4fi> ASSY- 


-51 ASSY - 


r 


e&F 


-=© ASSY - 


-50 - 


-45 ASSY — 



-SO - 


-45 ASSY - 


I NSTALLAT10K1 -I 

COMTBOL EOOS -52,-9%. 25IN2&M-I AMP 
Z5IN2M2-5 OMITT&P FOZ CLAZ ITV 


FEONJT VIEW 



Figure D-21. Summing Mechanism Installation (Drawing: ACT-L0-FCD102)-Sheet 2 of 16 
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Figure D-21. Summing Mechanism Installation (Drawing: ACT-LO-FCD102)- 
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Figure D-21. Summing Mechanism Installation (Drawing: ACT-LO-FCD102)- 
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Figure D-21. Summing Mechanism Installation (Drawing: ACT-L0-FCD102)-Sheet 4 of 16 
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Figure D-21. Summing Mechanism Installation (Drawing: ACT-LO-FCD102)Sheet 6 of 16 


Figure D-21 Summing Mechanism Installation (Drawing: ACT-LO-FCD102)- 
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Figure D-21. Summing Mechanism Installation (Drawing: ACTL0-FCD1 02)- 
Sheet7of 16 
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ACT-LO-FCD102 Parts List 


QTV 



ADJUSTER- 

SPRING 


1.1 X 3.1 X 6.5 


1.1 X 2.9 X 5.6 


.125 DIA X 52 LG 


.177 DIA X 50 LG 


1.7 X 1.7 X 2.8 


Ml, 

FI, 

F3 

Ml, 

FI, 

F3 

M3, 

F5 


M3, 

F5 


M5, 

P2, 

F9 
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ACT-LO-FCD102 Parts List 
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ACT-LO-FCD102 Parts List 
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ACT-LO-FCD102 Parts List 


QTV 




PART NO. 

DESCRIPTION 

69-38919-18 

SLEEVE- 
BRG RETENTION 

-38 

LUG ASSY 
UPPER SUMMING 

-40 

LUG 

BACB10AN4 

BEARING 

69-38919-20 

SLEEVE- 

BRG RETENTION 

-42 

LUG ASSY- 
LOWER SUMMING 

-44 

LUG 

BACB10AN4 

BEARING 

69-38919-20 

SLEEVE- 
BRG RETENTION 

MS 90354-6 

RIVET 


STOCK SIZE 




PART NO. 

DESCRIPTION 

-31 

TORQUE TUBE 
ASSY 

-46 

TUBE ASSY 

-47 

TUBE-INNER 

-48 

TUBE-OUTER 

-33 

LUG ASSY- 
UPPER PIVOT 

-35 

LUG-UPPER 

-37 

LUG-LOWER 

BACB10AR6 

BEARING 

69-38919-18 

SLEEVE- 
BRG RETENTION 

-49 

LUG ASSY- 
LOWER PIVOT 

-50 

LUG 

BACB10AR6 

BEARING 



1.625 OD X .065 WALL 
X 9.S LG 


1.625 ID X .065 WALL 
X 9.8 LG 


1.1 X tt.lt X 6.3 


1.1 X 4.9 X 6.3 


NOTES 


F3, P6, P8 


P7 


M4, PI 


M4, PI 


F3, P3, P4 
P5, P6, P8 


Ml, PI, FI 


OPPOSITE-35 
Ml, FI, PI 
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ACT-LO-FCD102 Parts List 


OTV 




PART NO. 

DESCRIPTION 

69-38919-18 

SLEEVE 

BRG RETENTION 

-39 

LUG ASSY- 
UPPER SUMMING 

-41 

LUG 

BACB10AN4 

BEARING 

69-38919-20 

SLEFVE- 
BRG RETENTION 

-43 

LUG ASSY- 
LOWER SUMMING 

-45 

LUG 

BACB10AN4 

BEARING 

69-38919-20 

SLEFVE- 

BRG RETENTION 

MS90354-6 

RIVET 


STOCK SIZE 



.9 X 2.8 X 6.4 


P3,P4,P5 


Ml, PI, FI 




PART NO. 

DESCRIPTION 

-51 

SPRING GUIDE 

-52 

CONTROL ROD 
ASSY 

-54 

TUBE 

BACB10AE-9A 

BEARING- 
ROD END 

-53 

CONTROL ROD 
ASSY 

-55 

TUBE 

BACB10AE-9A 

BEARING ROD END 

BACB30NF4-6 

BOLT 

BACB30NF4-10 

BOLT 

BACB3QNF4-14 

BOLT 

BACB30NF4-22 

BOLT 


1.38 DIA X .4 LG I M5,P2,F4 


PS.F3 


1.00 D1A X .035 WALL 

X21.6 LG M2.F2 
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ACT-LO-FCD102 Parts List and Notes 


wv 

PART NO. 

DESCRIPTION 

STOCK SIZE 

NOTES 


□ 

r 

i 

-i 





2 

BACB2SAK06-075 

BUSHING 







2 

BACB28AK06-085 

BUSHING 







2 

BACB28AK 06-286 

BUSHING 







6 

BACB28AK06-025 

BUSHING 







2 

BACB28AK 09-060 

BUSHING 







2 

BACB30FM9-29 

BOLT 







2 

BACB30FM9-1S 

BOLT 







2 

BACB30LL9-38 

BOLT 




Ml ALUMINUM ALLOY 7Q75-T7351 BAR PER QQ-A-225/9. ULTRASONIC 

INSPECT PER BAC5939, CLASS B. 

M2 2029-0 ALUMINUM ALLOY TUBE PER WW-T-700/3. HEAT TREAT TO 

T92 PER BAC5602. 

M3 9259 STEEL WIRE PER ASTM A901. 

M9 2029-T3 ALUMINUM ALLOY SEAMLESS TUBING PER WW-T-700/3 TYPE l. 

M5 15-5 PH BAR PER AMS 5659. HEAT TREAT TO 150-170 K5I PER BAC5619. 

PI PENETRANT INSPECT PER BAC5923. 

P2 MAGNETIC PARTICLE INSPECT PER BAC5929. 

P3 INSTALL BEARING PER BAC5935. 

P9 ROLLER SWAGE SLEEVE PER BAC5935. 

P5 FILL END GAP IN 69-38919 SLEEVE WITH DOW-CORNING Q3-0121 

SEALANT PER BAC5000 AFTER 5W AGING. 

P6 FAYING SURFACE SEAL WITH BMS 5-95 SEALANT PER BAC5000. 

INSTALL RIVETS/FASTENERS WITHIN CURING TIME OF SEALANT. 

P7 CLEAN WITH M.E.K. PER BAC5750 AND BOND OVER CURED BMS10-U 

PRIMER PER BAC5010 TYPE 70. SWAGE OR DRAW OUTER TUBE OVER 
INNER TUBE (AFTER APPLICATION OF PRIMER AND ADHESIVE) TO 
MEET REQUIRED OUTSIDE DIA. OPTIONAL FINISH MACHINE AFTER SWAGING. 

Figure D-21. Summing Mechanism Installation (Drawing: ACT-LO-FCD102)-Sheet 14 of 16 
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Notes for ACT-LO-FCD102 Parts List (Continued) 


P8 INSTALL FASTENERS WITH F-20.06 

P9 INSTALL BUSHING PER BAC5935. FAY FILLET SEAL WITH BMS 3-93 

SEALANT PER BAC5000. 

FI F-18.13. OMIT PRIMER ON F1NSHED HOLE DIAMETERS. 

F2 F-18.07 

F3 AFTER MACHINING F-17.10. 

F9 F- 16.01 

F5 F-20.03 

| 21 > ACT SUMMING UNIT RIGGING PROCEDURE 


This procedure should be used in place of 251N2001 Sht. 2 Para. 15.0 P. C. U. input rod 
adjustment. (757 Elevator Control Rigging Instructions) 

A. Summing Lever Spring Adjustment 
Depressurize all Hydarulic Systems 

1. Remove all tension from the R. H. summing lever spring. (ACT-LO-FCD 102) 

2. Insert rig pin #7 (251N20Q1) at aft quadrant. 

3. Disconnect the control rod between the R. H. summing mechanism and the R. H. 
idler lever. 

9. Remove the control rod between the L. H. summing mechanism and the quad 
shaft. (ACT-LO-FCD 101) 

5. Remove all spring tension from the voting cam follower arm. 
(ACT-LO-FCD 101) 

6. Rotate the quadshaft clockwise by applying a force to the L. H. quadshaft output 
arm. Force should be increased to a level at which the R. H. ACT rig Pin can be 
inserted between the summing lever and sumshaft. Force applied at the 
quadshaft input arm to allow insertion of the rig pin should be 7 lb. + 2 lbs. 


Figure D-21. Summing Mechanism Installation (Drawing: ACT-LO-FCD102)-Sheet 15 of 16 
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Notes for ACT-LO-FCD102 Parts List (Concluded) 


7. To obtain the correct force at the quadshaft input arm, adjust the summing lever 
spring tension by rotating the nut provided at the spring anchor. 

8. Remove Rig Pin #7 and R. H. ACT Rig Pin. 

9. To adjust the L. H. summing lever spring, repeat steps 1 thru 8 substituting 
"L. H." for "R. H." and "R. H." for "L. H." in all cases. 

10. Replace voting cam follower arm spring. 

11. Replace all control rods. 

B. Summing Mechanism Rigging 

Depressurize all Hydraulic Systems 

1. Complete R. H. Summing lever spring adjustment. 

2. Insert Rig Pins It 7 & it 9. (251N20Q1) 

3. Remove the new control rod connecting the R. H. summing mechanism to the 
quadshaft. (ACT-LO-FCD 101) 

4. Adjust the existing control rod between the inb'd R. H. P.C.U. bellcrank and the 
R. H. idler lever until the R. H. ACT Rig Pin can be freely inserted. 

5. With the R. H. ACT Rig Pin inserted, install the control rod between the R. H. 
summing mechanism and the quad shaft and adjust the rod length until the rod 
end bolts can be freely inserted. 

6. Remove Rig Pins 7, 9, and R. H. ACT Rig Pin. 

7. To rig L. H. summing mechanism repeat steps 1 thru 6 substituting "L. H." for 
"R. H." in all cases. 


Figure D-21. Summing Mechanism Installation (Drawing: ACT-LO-FCD102)-Sheet 16 of 16 
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D.3 SECONDARY ACTUATORS (S250N101) 


A survey was conducted to determine if a servoactuator in current use on a Boeing 
airplane could meet the restrictions of electrical compatibility and physical envelope 
while providing adequate output torque and angular authority. The unit selected for use 
as the Test ACT elevator secondary actuator is the 757 rollout guidance servoactuator, 
part number S251N312-4, primarily because of its output torque, authority limits, and 
physical envelope. 

To create the Test ACT secondary actuator from the 757 rollout guidance servo, the 
following modifications must be made: 

• Replace the existing electrohydraulic servovalve (EHSV, 10-60813-1) with one that 
will provide sufficient flow to operate the actuator at a rate of 55 deg/sec. The 
replacement EHSV must have mounting and hydraulic provisions compatible with the 
existing actuator manifold. Electrical characteristics (excitation voltage, resistance, 
inductance, connections, etc.) must be the same as those of the existing valve. 

• To accommodate the increase in flow rate through the unit, some drill passages in the 
actuator manifold need to be enlarged and the flow restrictors omitted. 

• Replace the existing output shaft with a solid shaft of larger diameter at both the 
outer seal and outer bearing locations. These changes increase the stiffness of the 
driving elements, as a means of reducing the compliance and overall hysteresis of the 
actuator, to meet the requirements of Figure D-4. 

o Increase the size of the outer bearing to further reduce actuator compliance. 

e Increase the size of the outer shaft seal to accommodate the previously mentioned 
shaft diameter change. 

• Because of 757 space constraints, the actuator installation necessitates a different 
output lever for each of the four units. The material of the levers will be changed 
from aluminum to 15-5 PH steel to achieve additional stiffness. 
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• The effect of the changes to the output shaft and levers will increase the actual 
stiffness values of the output drive train from 698 kN/m (3990 lbf/in.) to 1136 kN/m 
(6500 lbf/in.). 

• A fifth actuator will be procured for use as a spare unit to support the Test ACT 
flight test program. Since all four actuators are unique assemblies by virtue of their 
output lever differences, the existing permanent fasteners used to secure the levers 
to the output shafts will be replaced with bolts and locking nuts to facilitate 
adaptation of the spare unit to any installation position. 

D.4 AUTOPILOT SERVOACTUATOR (S250N102) 

The requirement for a single autopilot channel during mechanical flight will be met by 
retaining one of the 757 pitch autopilot servos. The following modifications will be made 
to satisfy additional requirements levied against the mechanical control system: 

• The addition of a centering valve to the pitch autopilot servo, sandwiched between 
the EHSV and the actuator manifold, provides a solenoid-controlled hydraulic bypass 
of the mod-piston chambers. Figure D-22 shows the autopilot hydraulic schematic 
and the functional relationship of the centering valve. The valve is in the 
deenergized or bypass position during fly-by-wire flight, preventing transmission of 
autopilot position signals, while the actuator is serving as an added detent. During 
mechanical flight, the valve is in the energized or transmitting position, allowing use 
of the actuator for conventional autopilot functions. 

• To provide a detent force sufficiently high to react the FBW-mode linkage loads, the 
existing centering springs in the autopilot servoactuator will be replaced with springs 
and a retainer that result in a nominal breakout force of 452. 9N (102 lb) at the mod- 
piston centerline. This enhances the existing feel unit centering force by the 
equivalent of 57.7N (13 lb) at the control column. 
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Figure D-22. Autopilot Servo Functional Schematic 
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D.5 PRIMARY ACTUATORS 


Measurements on the 757 Flight Control Test Rig (FCTR) indicate the hysteresis of the 
elevator mechanical control system may be too high to satisfy the Test ACT requirements 
during the aft eg flight conditions. These and similar 767 FCTR tests indicate the surface 
power control unit (PCU) contribution to overall hysteresis is significant and can be 
reduced by the addition of a bias spring to the PCU control valve spool, as shown in 
Figure D-23. 

To create the Test ACT primary actuators from the existing 757 elevator PCUs, the 
following modifications are required: 

• Add a 2.2-N (0.5-lb) bias compression spring behind the control valve spool 

• Add spring retainers at both ends of the bias spring to ensure positive application of 
load and to prevent generation of contaminants in the valve cavity 


( 



Figure D-2 3. PCU Bias Spring Installation 
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